3.1.0 - pin-audit + preset improvements

Adds the pin-audit component (I1 enforcement: fails the build on an image pin
Renovate cannot track forward -- bare @sha256 / commit-SHA tag) + the ADOPTION.md
adoption profile, now adoptable by consumers (pin-audit postdated the 3.0.0 tag,
so pin-audit@3.0.0 never resolved). Plus renovate-config preset improvements
accumulated since 3.0.0 (abandonment signal, automerge-pin, astro/vitest ecosystem
grouping, rebaseWhen=behind-base-branch, lockFileMaintenance release-age exemption,
trusted-upstream fast-track, mise-gitlab manager de-dup) and ci/ci-iac fixes.

No breaking change: every component's inputs and behavior are unchanged from 3.0.0.
Minor bump.