chore: Add renovate custom manager to update upper-bound files

[lqiu96]

Dependencies CI Test: https://github.com/googleapis/sdk-platform-java/actions/runs/17332601428

Local invocation of renovate shows that it is able to match the versions:

{
                 "depName": "com.fasterxml.jackson:jackson-bom",
                 "currentValue": "2.19.2",
                 "datasource": "maven",
                 "replaceString": "com.fasterxml.jackson:jackson-bom=2.19.2\n",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "2.20.0",
                     "newValue": "2.20.0",
                     "releaseTimestamp": "2025-08-28T22:48:03.000Z",
                     "newVersionAgeInDays": 0,
                     "newMajor": 2,
                     "newMinor": 20,
                     "newPatch": 0,
                     "updateType": "minor",
                     "isBreaking": false,
                     "branchName": "renovate/com.fasterxml.jackson-jackson-bom-2.x"
                   }
                 ],
                 ...
             ],
             "matchStrings": ["(?<depName>.*)=(?<currentValue>.*)\\n"],
             "datasourceTemplate": "maven",
             "packageFile": "dependencies.txt"
           }

[lqiu96]

I guess there is the possibility that the artifactId may be duplicated across OSS projects. Could be enhanced so that it is {groupId}.{artifactId}.version format

[lqiu96]

There is a possibility that there are other pom.xml files that inherit from here and shared-deps that use these values. Would we consider changing these property names a breaking change?

[sonarqubecloud]

Quality Gate passed for 'gapic-generator-java-root'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed for 'java_showcase_integration_tests'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud