chore(ci): adopt shared workflows and central Renovate preset

[TheMeinerLP]

What

Brings this repository onto the OneLiteFeather standard CI, release and dependency setup.

CI, security and dependencies

• moved .github/renovate.json to renovate.json
• renovate.json -> central preset (coincoffer-maintainers)
• security.yml (Trivy + CycloneDX SBOM)
• build-pr.yml (gradle-build-pr, Java 17, run-tests: false)
• close_invalid_prs.yml (replaced hand-rolled job)
• pinned reusable workflows to v2.8.1 (close_invalid_prs.yml)

Release automation and PR hygiene

• pr-lint.yml + commitlint config
• release-please simple mode, bootstrapped at 1.0.1
• SBOM attached to every release
• Hangar/Modrinth publish moved from the tag trigger into the release-please run
• removed release-drafter, superseded by the release-please changelog

Version anchoring and Renovate presets

• marker on baseVersion (the derived version keeps its own logic)
• extra-files now points at build.gradle.kts
• bootstrap-sha set from tag 1.0.1

Why

One shared setup per concern instead of a hand-maintained copy per repository:

• Reusable workflows (OneLiteFeatherNET/workflows) are pinned to a full SemVer tag, so a fix
  in the shared catalogue reaches this repository through a Renovate PR.
• Central Renovate preset brings the shared schedule, automerge and labelling rules and assigns
  the maintainer team as reviewer, instead of a per-repository config that drifts.
• Security gate: Trivy scans for vulnerabilities and secrets and reports into GitHub code
  scanning, plus a CycloneDX SBOM on every run. Report-only, so adopting it does not turn CI red on
  day one.
• Release Please in simple mode turns Conventional Commits into a release PR; merging it tags
  the version and cuts the release. Simple mode deliberately does not rewrite language version
  files, which keeps this change limited to release plumbing.
• A CycloneDX SBOM is attached to every GitHub release, so each shipped version carries its own
  dependency inventory.
• The Renovate platform preset (:minestom / :paper) is what teaches Renovate the
  date-based Minestom scheme and Paper's X.Y.Z-<mc-version> scheme; without it those two get
  parsed as plain SemVer and updated wrongly.
• The version lives in build.gradle.kts behind // x-release-please-version, so a release
  changes exactly one line in one file instead of a properties file the build has to parse.
• PR linting enforces Conventional Commits on the PR title and on every commit - without it
  release-please silently fails to bump the version or drops the commit from the changelog.

Everything a release needs is chained into the release-please workflow run on purpose: release-please
tags with GITHUB_TOKEN, and a tag pushed that way does not start a separate
on: push: tags workflow.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.