[build] Automated dependency upgrades with renovate

[jwnimmer-tri]

Is your feature request related to a problem? Please describe.

To the extent possible, we would like to automate version bumps of our dependencies.

Describe the solution you'd like

Enable Renovate (add a .github/renovate.json file and add it as an app).

To start with, let's just configure it to bump .bazelversion for us.

Later, after WORKSPACE support has been dropped, we could consider it for MODULE.bazel as well. Parts of //tools/workspace:new_release could/should be hoisted onto renovate, instead.

Later, after our venvs are more widely used, we could have possibly it bump those lockfile(s) also.

[jwnimmer-tri]

FYI I have authorized the app on RobotLocomotion/drake now. Once we add a json file, it should kick in.

Please configure the bot to open PRs on or around the 1st of the month like we currently do for our manual upgrades, rather than "at any time".

We also should upgrade to bazel 8.3.1 (we're on 8.2.1 now). That would serve as nice proof that it's working well.

[jwnimmer-tri]

See #23160 for the onboarding PR. We should customize that (maybe in a new PR).

Also xref:

• https://github.com/RobotLocomotion/drake-external-examples/blob/main/.github/renovate.json
• https://github.com/RobotLocomotion/drake-blender/blob/main/.github/renovate.json
• https://github.com/RobotLocomotion/models/blob/master/.github/renovate.json