[jmacauley]

Adds .github/renovate.json following the nsi-dds and nsi-pce policy: an eight-day release delay, grouped minor/patch automerge, and immediate pin/digest updates. Spring Boot and common-lib stay separate and require manual merging; major upgrades require dashboard approval and manual merging, and Java runtime updates are disabled.

Adds 13 Maven property mappings for versions inherited through the Spring Boot parent and documents the policy, validation, and activation prerequisites in README. No dependency versions change.

Validation:

• Renovate 44.190.0 strict config validation passed.
• Extraction found all 22 Maven entries and GitHub Actions; 19 evaluated policy scenarios passed.
• All 21 public Maven lookups resolved.
• mvn --batch-mode --no-transfer-progress clean verify passed on JDK 21: 84 tests, zero failures/errors/skips.
• git diff --check passed.

Activation requires Renovate app access, private GitHub Packages credentials, repository auto-merge, and all eight compatibility checks configured as required. Private common-lib lookup and authenticated Actions lookups remain unverified; the full four-JDK matrix was not run locally.