[DND-1779] Onboard to central Renovate with the security preset

[AndreiCautisanu]

What

New .github/renovate.json extending github>comet-ml/renovate-config:security (allowlisted in comet-ml/renovate-config#25, which should merge first), for the images this chart ships inside the self-hosted release:

• busybox 1.36 → 1.38 from values.yaml;
• the s3proxy image, whose tag defaults to the chart's appVersion, which helm-values can't see, so a small regex manager on Chart.yaml reads it. 3.3.0 → 4.x is a major, so it waits for a Dependency Dashboard tick.

Heads-up: verify-chart-version requires a chart version bump on every PR touching charts/s3proxy/, and Renovate can't bump it for these managers (bumpVersion only supports helmv3/npm/maven/nuget/sbt). Either push a version bump onto the Renovate branch before merging, or exempt renovate/* branches in that workflow.

Previewed locally with Renovate 44.155.4 (platform=local, dryRun=lookup) against the live security preset. Version-update PRs open on the first Monday of the month; vulnerability PRs on any of the Mon/Wed/Fri runs. Part of the self-hosted CVE loop (DND-1779).

🤖 Generated with Claude Code

[github-actions]

📊 Helm Render Diff Summary

Chart charts/s3proxy rendered with Kubernetes 1.29.0. Informational only — this check never fails the PR.

Values File	Chart Path	Changes	Status
test-values/auth-existing-secret.yaml	charts/s3proxy	-	✅ No Changes
test-values/autoscaling.yaml	charts/s3proxy	-	✅ No Changes
test-values/azureblob-existing-secret.yaml	charts/s3proxy	-	✅ No Changes
test-values/azureblob-managed-identity.yaml	charts/s3proxy	-	✅ No Changes
test-values/azureblob.yaml	charts/s3proxy	-	✅ No Changes
test-values/b2.yaml	charts/s3proxy	-	✅ No Changes
test-values/filesystem.yaml	charts/s3proxy	-	✅ No Changes
test-values/gcs.yaml	charts/s3proxy	-	✅ No Changes
test-values/ingress.yaml	charts/s3proxy	-	✅ No Changes
test-values/multi-backend.yaml	charts/s3proxy	-	✅ No Changes
test-values/openstack-swift.yaml	charts/s3proxy	-	✅ No Changes
test-values/rackspace.yaml	charts/s3proxy	-	✅ No Changes
test-values/s3.yaml	charts/s3proxy	-	✅ No Changes
test-values/tls-existing-secret.yaml	charts/s3proxy	-	✅ No Changes
test-values/tls.yaml	charts/s3proxy	-	✅ No Changes
test-values/transient.yaml	charts/s3proxy	-	✅ No Changes

🎉 No changes detected in any of the tested configurations!