Implement Renovate for automated lockfile updates?

[apetro]

If we want automated lockfile updates, renovate supports it without needing a secret key to be added to public CI.

[ChristianMurphy]

📓 related to #659

[ChristianMurphy]

Semi related, a neat renovate trick which a few projects I'm on have been doing is scheduling dependency updates to sync with sprint cadence.

Dependency updates are scheduled for the start of a sprint, QA can start the sprint by regression testing with the dependency updates, by the time QA is done regression testing, the first feature stories are being merged.

[apetro]

MyUW doesn't have a distinct QA team, but that'd still probably be the right cadence in that we can most tolerate instability at the beginning of a sprint and are looking to stabilize and release by the end of / before the next sprint.