Use renovate for dependency updates (#1054)

1. Disable dependabot for normal dependency updates. Note the dependabot PRs will need to be manually closed, and the "security" dependabot PRs will continue.

2. Use renovateapp instead.

The renovate configuration included here is based on that from ads-serve, and:

a. waits for updates to have been published for 4 days before raising a PR - this both reduces churn and also avoids the 3 day period where npm-published entries can be "unpublished"
b. combines all minor and patch updates into a single PR

renovate.json

@@ -0,0 +1,18 @@
+{
+  "extends": ["config:js-app", ":semanticCommitsDisabled"],
+  "labels": ["dependencies"],
+  "postUpdateOptions": ["npmDedupe"],
+  "packageRules": [
+    {
+      "matchDatasources": ["npm"],
+      "minimumReleaseAge": "4 days"
+    },
+    {
+      "groupName": "all non-major dependencies",
+      "groupSlug": "all-minor-patch",
+      "matchPackagePatterns": ["*"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchDatasources": ["npm"]
+    }
+  ]
+}