feat: automerge security (vulnerability) updates on green CI

Security PRs raised via vulnerabilityAlerts had no automerge, so they
sat open until merged by hand — e.g. blog-svelte #35 (sharp) stayed open
even though CI was green. These are exactly the updates that should land
fastest, and platformAutomerge still gates them on the required checks.

Add automerge to the vulnerabilityAlerts block. It overrides the per-repo
group rules (e.g. the ungrouped 'svelte + build toolchain'), because
Renovate splits vulnerability updates into their own branches anyway.

Signed-off-by: Peter Siegmund <peter.siegmund@entwicklung.eq-3.de>

default.json

@@ -10,7 +10,8 @@
   "osvVulnerabilityAlerts": true,
   "vulnerabilityAlerts": {
     "minimumReleaseAge": null,
-    "schedule": ["at any time"]
+    "schedule": ["at any time"],
+    "automerge": true
   },
   "lockFileMaintenance": {
     "enabled": true,