Feature: automate bumps of dependencies under third_party/

[viccuad]

Currently, bumping k8s.io/apiserver is a manual process, as we have trimmed unexercised code from it to make the policy slimmer, and slotted it under third_party/ as is standard for go code in this case.

We would like to bump the code under third_party/ automatically.

Acceptance criteria

• Disable renovatebot for code under third_party/ (k8s.io/apiserver). ci: Configure Renovatebot to ignore k8s.io/apiserver #74
• Write automation with updatecli that detects new releases of k8s.io/apiserver and opens a PR that bumps the needed files. This would be similar to the manual process: bumping the whole k8s.io/apiserver, trimming (new) files that are unneeded, and applying patches if needed.
• Schedule the updatecli automation to run once a week with GHA.