chore: normalize renovate dependency updates (#274)

## What and why

Enable grouped monthly Renovate updates for GitHub Actions and root Yarn
dependencies while preserving the repository-selected Foundry and
Solidity 0.7-compatible OpenZeppelin versions. Production and
development npm dependencies are kept together to minimize PR noise.

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: igorroncevic <57319163+igorroncevic@users.noreply.github.com>

Author: renovate[bot]

.github/renovate.json5

@@ -2,8 +2,14 @@
 // easier to maintain.
 {
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
-  // Disable every built-in manager (npm, dockerfile, ...) except github-actions.
-  enabledManagers: ["github-actions"],
+  // Enable only the package managers used by this repository.
+  enabledManagers: ["github-actions", "npm"],
+  npm: {
+    managerFilePatterns: ["/^package\\.json$/"],
+  },
+  // Keep the Solidity 0.7-compatible OpenZeppelin release selected by this
+  // repository; newer OpenZeppelin majors require Solidity 0.8.
+  ignoreDeps: ["@openzeppelin/contracts"],
   // PR titles use Conventional Commits: `deps(<action>): ...`
   semanticCommits: "enabled",
   semanticCommitType: "deps",
@@ -16,7 +22,7 @@
     // (typically major) instead of a separate minor PR.
     {
       matchManagers: ["github-actions"],
-      schedule: ["* 0-3 1 * *"],
+      schedule: ["* 0-3 1 * *"], // 00:00-03:59 UTC on the first day of each month
       minimumReleaseAge: "14 days",
       // Track upgrades by semver tag, but pin the resolved version to its full
       // commit SHA (semver tag kept as a trailing comment). Use the coerced
@@ -25,8 +31,21 @@
       versioning: "semver-coerced",
       pinDigests: true,
       separateMajorMinor: false,
+      groupName: "GitHub Actions",
+      groupSlug: "github-actions",
       semanticCommitScope: "{{depName}}",
       commitMessageTopic: "{{depName}}",
     },
+    // Keep all Yarn-managed npm updates in one monthly PR.
+    {
+      matchManagers: ["npm"],
+      schedule: ["* 0-3 1 * *"], // 00:00-03:59 UTC on the first day of each month
+      minimumReleaseAge: "14 days",
+      separateMajorMinor: false,
+      groupName: "npm dependencies",
+      groupSlug: "npm-dependencies",
+      semanticCommitScope: "npm-dependencies",
+      commitMessageTopic: "npm dependencies",
+    },
   ],
 }