ci: let Renovate bump the golangci-lint pin in scripts/lint.sh (#5231)

scripts/lint.sh and .github/workflows/lint.yml both pin a golangci-lint
version and carry comments saying they must match, but no Renovate manager
reads shell scripts. Every workflow bump therefore leaves the script behind
and someone has to notice: it happened in #5036 (v2.11.4 vs v2.12.2) and
again in #5197 (v2.12.2 vs v2.13.1).

A regex custom manager extracts the version from the script, and grouping on
the dep name keeps it in the same PR as the workflow bump.

Co-authored-by: Cursor <[email protected]>

.github/renovate.json

@@ -1,4 +1,21 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>trufflesecurity/.github:renovate-config#v1.0.4"]
-}
+  "extends": ["github>trufflesecurity/.github:renovate-config#v1.0.4"],
+  "customManagers": [
+    {
+      "description": "scripts/lint.sh pins the same golangci-lint version as .github/workflows/lint.yml",
+      "customType": "regex",
+      "managerFilePatterns": ["scripts/lint.sh"],
+      "matchStrings": ["GOLANGCI_LINT_VERSION=\"(?<currentValue>v[^\"]+)\""],
+      "depNameTemplate": "golangci/golangci-lint",
+      "datasourceTemplate": "github-releases"
+    }
+  ],
+  "packageRules": [
+    {
+      "description": "Keep the workflow and script golangci-lint pins in one PR",
+      "matchDepNames": ["golangci/golangci-lint"],
+      "groupName": "golangci-lint"
+    }
+  ]
+}