Add Renovate bot to automate dependency updates

[lucastigera]

Description

Enables a Renovate bot for tigera/operator, bringing it to parity with the core
dependency automation that already runs in projectcalico/calico. Until now the
operator's Go modules, Go toolchain, and calico/base image have been bumped by hand.

Type of change: new feature / CI tooling (no product code changes).

This mirrors calico's setup — a renovate.json config plus a .semaphore/renovate.yml
pipeline run on a Semaphore schedule — adapted to the operator's file layout. Like
calico's, it is deliberately not a blanket dependency bumper: it tracks a small,
safe, patch-focused set and groups everything into a single PR.

What it tracks

• Go modules (patch-focused): k8s.io/** → patch; golang.org/x/** → patch + minor;
  all other Go modules disabled. go mod tidy runs after each update
  (postUpdateOptions: ["gomodTidy"]).
• Go language version: the go x.y.z directive in go.mod (golang-version
  datasource), patch-only.
• calico/base image: CALICO_BASE_VER in the Makefile (docker datasource,
  ubiN-<serial> regex versioning), tolerant of ?=.
• Go-build toolchain parts: GO_VERSION → golang (golang-version) and
  K8S_VERSION → kubernetes/kubernetes (github-releases, v-prefix extract),
  both patch-only. See the GO_BUILD_VER decomposition below.

GO_BUILD_VER decomposition (Makefile)

GO_BUILD_VER was a single opaque string. Mirroring calico, it is now composed from
individually-addressable parts so each can be tracked/bumped on its own:

GO_VERSION?=1.26.4
K8S_VERSION?=v1.36.2
LLVM_VERSION?=21.1.8
GO_BUILD_VER?=$(GO_VERSION)-llvm$(LLVM_VERSION)-k8s$(K8S_VERSION:v%=%)

This resolves to the identical value (1.26.4-llvm21.1.8-k8s1.36.2); K8S_VERSION
carries a leading v stripped on interpolation via $(K8S_VERSION:v%=%). LLVM_VERSION
is decomposed for clarity but not Renovate-tracked (no datasource), same as calico.

Note: Renovate only edits the version text; the resulting calico/go-build:<tag> is a
downstream image built by projectcalico/toolchain. If a matching tag isn't published
yet, CI simply fails and the PR stays unmerged — master is never broken (same model as
calico).

Global behaviour (mirrored from calico)

• All updates grouped into one PR (groupName: dependency-updates).
• Minor / major / digest blocked globally (with the golang.org/x minor exception above).
• baseBranchPatterns: release-v1.40, release-v1.42, release-v1.43, master.
• vulnerabilityAlerts enabled, rebaseWhen: behind-base-branch, PR limits 20/20.

Semaphore job

.semaphore/renovate.yml: ubuntu2204 VM, nvm install 24, renovate@43,
renovate --platform=github --autodiscover=false, RENOVATE_REPOSITORIES=tigera/operator,
RENOVATE_GIT_AUTHOR=marvin-tigera. Reuses the org secrets marvin-renovate-token-enterprise
(GitHub PAT) and private-repo (SSH key for private tigera/* module fetches, ssh-add
in the prologue). The cron schedule is configured as a Semaphore scheduled Task in
project settings — it is not committed here, same as calico.

Bundled: imported-CRD regeneration

This branch also includes a make gen-versions regeneration of the bundled
calico/enterprise CRDs (eck bundle 3.4.0 → 3.4.1, plus felixconfigurations v1/v3 and
wafpolicies content). This clears a pre-existing, Renovate-unrelated dirty-check
failure caused by upstream master drift (the CRDs are pinned at version: master).
Included here to keep this PR's CI green; re-run make gen-versions before merge if
upstream drifts again.

Differences from the calico base config (intentionally dropped / adapted)

• skip-bot-cherry-pick label — dropped. No such label exists in tigera/operator.
  Kept labels the operator actually has: docs-not-required, release-note-not-required,
  dependencies.
• merge-when-ready / delete-branch labels — dropped for now. These drive
  auto-merge and branch cleanup. Omitted for the initial runs so we can build confidence
  with PRs that stop at "opened"; they can be added back later.
• npm manager — dropped. The operator has no package.json.
• metadata.mk managers — adapted. The operator has no metadata.mk; calico's
  GO_VERSION/K8S_VERSION/CALICO_BASE_VER regex managers (which point at
  metadata.mk) are re-pointed at the operator's Makefile, and tolerate ?=.
• make gen-deps-files postUpgradeTasks + RENOVATE_ALLOWED_COMMANDS — dropped.
  The operator has no deps.txt generation step; it relies on gomodTidy instead.
• baseBranchPatterns — adapted to the operator's active release branches
  (release-v1.40/-v1.42/-v1.43 + master) instead of calico's release-v3.31/-v3.32.
  Note: release-v1.40's Makefile uses a different base-image scheme (no CALICO_BASE_VER),
  so calico/base is not tracked on that branch — Go modules and the go directive still are.

Testing

Validated locally against the real repos before/while iterating on this PR:

• renovate-config-validator — config passes schema validation.
• Full renovate --dry-run against tigera/operator — extraction succeeds on all base
  branches; golang (go directive) and calico/base (with ?=) both extract; scoping is
  correct; updates group into renovate/<branch>-dependency-updates; vulnerabilityAlerts
  correctly opens security PRs that bypass the block rules.
• renovate --dry-run against the decomposed Makefile (fork branch) — the new GO_VERSION
  → golang and K8S_VERSION → kubernetes/kubernetes managers both extract and are
  patch-only.
• make gen-versions re-run is idempotent (clean tree) after the CRD regeneration commit.

Release Note

NONE

For PR author

• Tests for change. (N/A — CI tooling; validated via renovate-config-validator + dry-run)
• If changing pkg/apis/, run make gen-files (N/A)
• If changing versions, run make gen-versions (done — see CRD regeneration commit)

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.