fix(renovate): disable major updates for indirect Go deps

Go major version updates change module import paths (e.g. v1 → v2).
Indirect dependencies cannot be updated independently since the parent
module (e.g. sops) still imports the old paths. go mod tidy removes
the unused new entries during build, failing the verify step.

Also adds gomodUpdateImportPaths so direct major updates get their
source import paths updated automatically.

Author: markussiebert

renovate.json

@@ -9,6 +9,12 @@
       "groupName": "go-deps",
       "automerge": true
     },
+    {
+      "matchManagers": ["gomod"],
+      "matchDepTypes": ["indirect"],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
+    },
     {
       "matchManagers": ["npm"],
       "groupName": "npm-deps",
@@ -25,6 +31,6 @@
       "automerge": true
     }
   ],
-  "postUpdateOptions": ["gomodTidy"],
+  "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],
   "pinDigests": true
 }