chore: Automatically update dependencies monthly

This will update `Cargo.toml` and `Cargo.lock` at the same time.  By
default, all dependencies will be updated, so we pull out the compatible
dependencies into a consolidated PR.

This starts off with the dependency dashboard and automerging being
disabled but explicitly specified to call attention to the potential for
this.  We can evaluate these later.

Author: epage

.github/renovate.json5

@@ -0,0 +1,35 @@
+{
+  schedule: [
+    'before 3am on the first day of the month',
+  ],
+  semanticCommits: 'enabled',
+  configMigration: true,
+  dependencyDashboard: false,
+  packageRules: [
+    // Goals:
+    // - Rollup safe upgrades to reduce CI runner load
+    // - Have lockfile and manifest in-sync (implicit rules)
+    {
+      matchManagers: [
+        'cargo',
+      ],
+      matchCurrentVersion: '>=0.1.0',
+      matchUpdateTypes: [
+        'patch',
+      ],
+      automerge: false,
+      groupName: 'compatible',
+    },
+    {
+      matchManagers: [
+        'cargo',
+      ],
+      matchCurrentVersion: '>=1.0.0',
+      matchUpdateTypes: [
+        'minor',
+      ],
+      automerge: false,
+      groupName: 'compatible',
+    },
+  ],
+}