hold dependency updates back for 7 days (video-dev#4394)

* hold dependency updates back for 7 days

to reduce the risk of a hacked package version being merged in, because hopefully someone would notice in 7 days and have the hacked version removed.

Also enable `vulnerabilityAlerts` meaning if GitHub mark a version as venerable and have a fix, that is automatically created immediately.

* disable lock file maintenance

because it would update a transitive dependency early

renovate.json

@@ -3,6 +3,9 @@
   "labels": ["dependencies", "skip-change-log"],
   "commitMessagePrefix": "[skip netlify]",
   "prHourlyLimit": 0,
+  "prCreation": "not-pending",
+  "stabilityDays": 7,
+  "vulnerabilityAlerts": true,
   "packageRules": [
     {
       "matchPackagePatterns": ["*"],
@@ -16,6 +19,5 @@
       "matchDepTypes": ["peerDependencies"],
       "rangeStrategy": "widen"
     }
-  ],
-  "lockFileMaintenance": { "enabled": true }
+  ]
 }