fix upstream release tracking
In !48 (closed), renovate figured out there was something new in the report, and issued a merge request. While that's somewhat useful, it's going to be too noisy for us: we don't want to upgrade deps every time upstream makes a commit. We want to chase releases.
It's not clear to me how to do this with submodules, so some more research might be required. Another option is to drop renovate here completely and roll our own git checker for tags. Or implement that in renovate ourselves.
For now I've closed !48 (closed) so we shouldn't be bugged about that particular upgrade, but I think before long we'll have another MR about another upstream commit, so we'll want to figure out a better way soon.