chore(renovate): enable updates for indirect Go dependencies

Renovate's gomod manager skips deps marked `// indirect` unless a rule
enables them, so transitive modules were never proposed for update. That
is where Go CVEs usually land.

golang.org/x/net is the current example: v0.56.0 has been available since
2026-06-09 and fixes CVE-2026-46600 (HIGH), but go.mod still pins v0.55.0
because the dep is indirect. The last bump to v0.55 (#110) was hand-written
for the same reason.

The new rule only sets `enabled`, so the grouping and automerge from the
"Go dependencies (non-major)" rule still apply, and it is placed before the
major rule so major bumps stay disabled.

Validated with renovate-config-validator.

Author: carole-lavillonniere

renovate.json

@@ -23,6 +23,12 @@
       "groupName": "Go dependencies (non-major)",
       "automerge": true
     },
+    {
+      "description": "The gomod manager skips '// indirect' deps by default, so CVE fixes in transitive modules were never proposed (golang.org/x/net sat two minor versions behind for months). Enabling them here only sets 'enabled'; the grouping and automerge above still apply, and the major rule below still wins for major bumps.",
+      "matchManagers": ["gomod"],
+      "matchDepTypes": ["indirect"],
+      "enabled": true
+    },
     {
       "matchManagers": ["gomod"],
       "excludePackageNames": ["go"],