Problem: Renovate keeps opening major-bump PRs (Spring 5/6, Spring
Security 5+, Hibernate 5+) because the Maven Central versions newer
than what we pin in gradle.properties show up as available, and
[security] flags in those PRs amplify the noise. Each major is a
coordinated migration we are not ready for, and we close them by hand
every cycle. Recent examples: #2937, #2940, #2941, #2942.

Goal: encode the migration constraints in renovate.json so Renovate
stops offering majors that won't be merged. Stays consistent with the
same pinning pattern applied across the portlet repos in the recent
sweep (AnnouncementsPortlet, basiclti-portlet, FeedbackPortlet,
NotificationPortlet, etc.).

Changes:
- renovate.json: add three packageRules entries with allowedVersions
  - org.springframework:* / .data:* / .webflow:* → < 5.0
    (Spring 5+ requires a coordinated API migration; Spring 6+ adds
     Jakarta EE + Java 17 on top.)
  - org.springframework.security:* / .oauth:* → < 5.0
    (Bound to the Spring Framework 4.3.x line; moves in lockstep.)
  - org.hibernate:* / org.hibernate.orm:* → < 5.0
    (Hibernate 5+ has API + EntityManager changes; 6+ renames the
     groupId and needs Jakarta EE + Java 17.)

Notes: did not pin Spring LDAP (2.x is current line, 2.4.4 bump in
#2938 is a minor), Springfox (2.10.0 bump in #2935 is also a minor),
or Guava (#2939 to v32 is plausible — resource-server already runs
guava 32). These can flow through normally.

Closes #2937, #2940 (duplicates).
Closes #2941, #2942 (won't migrate this release).

Refs #2938, #2935, #2939 (allowed to proceed normally).