fix: Renovate could not look up any of the CI-pinned tools

[FZ2000]

Renovate reported, on its first run against this repo:

Failed to look up github-releases package ci-pinned-tools: no-result
Files affected: .github/workflows/ci.yml

My bug, and three separate ones behind that single message.

1. depNameTemplate: "ci-pinned-tools" was a name I invented. A
   datasource lookup needs a real package, so Renovate dutifully asked
   GitHub for a repository called ci-pinned-tools and got nothing. The
   depName is now CAPTURED from the URL — gitleaks/gitleaks,
   trufflesecurity/trufflehog — rather than templated to a constant.

2. markdownlint-cli arrives via npx, so it is an npm package. It was
   pointed at the github-releases datasource, which could never have
   resolved it whatever the name.

3. lychee tags its releases lychee-vX.Y.Z, not vX.Y.Z. A single
   matchString covering all three tarballs would have mis-parsed it, so
   it gets its own manager plus an extractVersionTemplate to recover
   the bare version from the tag.

Net effect of the bug: all five pinned tools — gitleaks, trufflehog,
lychee (twice) and markdownlint-cli — were unmanaged while the config
looked like it was managing them. That is the same failure mode as the
fileMatch/matchPackagePatterns options this file already had removed:
configuration that reads as coverage and provides none.

Verified by running each regex against the real ci.yml rather than
reasoning about it:

github-releases  -> gitleaks/gitleaks 8.30.1
                    trufflesecurity/trufflehog 3.96.0
github-releases  -> lycheeverse/lychee 0.24.2
npm              -> markdownlint-cli 0.45.0

Also converted renovate.json -> renovate.json5. Renovate reads it
natively, and the reasoning above is worth keeping next to the regexes —
plain JSON has no comment syntax, and the _comment key workaround trips
Renovate's unknown-option validation. Validated with a real JSON5 parser
against Renovate's published schema, after the first hand-rolled
comment-stripper I tried silently mangled an inline key.

Added a "CI pinned tools" package rule so these arrive as one grouped PR
rather than five.