Move dependency ownership to Renovate configuration

[trmartin4]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-30256

📔 Objective

This PR adds more flexibility to dependency management for sdk-internal to reflect the maturity of its dependencies to include multiple teams, as more teams take an active role in SDK development. It takes steps to make the dependency ownership in sdk-internal match clients, by doing the following:

1. Removes Platform ownership from Cargo.toml, Cargo.lock, package.json, and package-lock.json, so that dependency updates do not always trigger Platform review.
2. Renames renovate.json to renovate.json5 to match clients, allowing comments in the Renovate file for clarity.
3. Moves all dependencies from Cargo and NPM package managers into renovate.json5 so they can be explicitly managed by each team.
4. Ignores minor updates to match [PM-29822] Improve Platform dependency inflow clients#17981 in clients.
5. Assigns lockFileMaintenance to Platform to match [PM-29822] Improve Platform dependency inflow clients#17981 in clients.
6. Adds dep-ownership.ts script to match the one in clients, with the addition of Cargo dependencies as well as NPM and adds it to the lint.yml workflow.

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation
  team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed
  issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – f7397e98-0d56-47e4-bc5d-7221dbdf1043

Great job! No new security vulnerabilities introduced in this pull request

[github-actions]

🔍 SDK Breaking Change Detection Results

SDK Version: platform/assign-owners-in-renovate (de18bad)
Completed: 2025-12-30 18:17:46 UTC
Total Time: 249s

Client	Status	Details
typescript	✅ No breaking changes detected	TypeScript compilation passed with new SDK version - View Details

---

Breaking change detection completed. View SDK workflow

[djsmith85]

The Cargo.toml checks are great, we should probably also include them in dep-ownership over on clients so we can check them for apps/desktop/desktop_native/Cargo.toml

[djsmith85]

Removing gomod seems fine, as I can't see anything using go currently

[trmartin4]

Yep, I think that this was a holdover from when the SM SDK and its integrations were in the same repo, in that case we needed Go and Python.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.88%. Comparing base (948b207) to head (de18bad).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #639   +/-   ##
=======================================
  Coverage   78.88%   78.88%           
=======================================
  Files         291      291           
  Lines       31689    31689           
=======================================
  Hits        24998    24998           
  Misses       6691     6691           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[trmartin4]

The Cargo.toml checks are great, we should probably also include them in dep-ownership over on clients so we can check them for apps/desktop/desktop_native/Cargo.toml

Great catch! I've added the check here: bitwarden/clients#18153.