enable and catchup with renovate-cron

It might be useful to enable the renovate bot for this project.

At the very least we should have it regularly update the Containerfile's FROM so we always build and deploy on top of the latest Debian image.

Update: renovate-bot is live on this project, but there's a flurry of work to be done to catchup.

progress:

• invite @renovate-bot
• review onboarding MR (!204 (merged))
• ASAP rebuild the minified JS (fixed in CI instead, see !215 (merged))
• fix the JS compression workflow #179 (closed)
• review and merge incoming MRs (24!)
• review resulting (container?) diff after merging everything
• test in staging like mad
• deploy to prod

obviously, after this issue is closed, we perpetually need to review MRs from renovate, whee. at this time, it's kind of fun to play whack-a-mole with the MRs.

display: table
title: "@renovate-bot merge requests until 2025-09-11"
fields: title, state, assignee, reviewer, merger, created, merged
query: type=MergeRequest and author=@renovate-bot and created < 2025-09-11

The 2025-09-11 cutoff date above is rather arbitrary. of course @renovate-bot will keep publishing updates, and we had to close this issue at some point. we're confident, at the moment (2025-09-11) that most changes have been performed (apart django, see #190), so we're wrapping this up.