Fix shared Renovate revision pins

[rb3ckers]

Pin both Renovate workflows and all four shared presets to merged renovate-config commit c308265fc9a7ee7aecaf1590383094214045049a. This also covers the approval action and presets missing from the workflow-only bot PR #170.

The Docker base is already managed: the latest run extracted it, and a Renovate engine check confirmed Docker grouping, digest automerge and registry lookup. The pinned bci-nano:15.7 digest is current, so no Dockerfile change is needed.

Validation: strict Renovate config validation, Actionlint, offline Zizmor (no findings; existing suppressions retained), shared-pin consistency and image extraction/digest checks passed.

Tracking: https://github.com/StackVista/stackstate/issues/865

[LouisLotter]

All six shared references—the runner, approval action and four presets—consistently use merged renovate-config commit c308265. No blocking findings; CI passed.