ci: update MODULE.bazel.lock when updates packages

Renovate does yet handle `MODULE.bazel.lock`. See: renovatebot/renovate#25557

We do this as a workaround for that.

Author: alan-agius4

renovate.json

@@ -3,6 +3,11 @@
   "extends": ["github>angular/dev-infra//renovate-presets/default.json5"],
   "ignorePaths": ["tests/legacy-cli/e2e/assets/**", "tests/schematics/update/packages/**"],
   "ignoreDeps": ["io_bazel_rules_webtesting"],
+  "postUpgradeTasks": {
+    "commands": ["git restore .npmrc", "pnpm install --frozen-lockfile", "pnpm bazel mod tidy"],
+    "fileFilters": ["MODULE.bazel.lock"],
+    "executionMode": "branch"
+  },
   "packageRules": [
     {
       "matchFileNames": [