feat: add customUpdateCommands to allow overwrite update logic

[secustor]

Changes

This is a draft for a new customUpdateCommands configuration. Which if applied overwrites the replacement logic.

This iteration also supports lockfileMaintenance

Context

This is useful in combination with CustomManager, if the a simply replacing is not enough as external tooling could use the packageFile as state ( which version is currently applied )

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository:

TODOs:

• can we unify this with postUpgradeTasks?
• or at least reuse some parts?

[jamietanna]

Might be worth keeping a similar note to what we have re Post-upgrade tasks are blocked by default for security reasons ...?

[secustor]

We haven't such a note in postUpgradeTasks, but we can add such one to allowedCommands

[jamietanna]

Can we keep the same warning as we have in lib/workers/repository/update/branch/execute-post-upgrade-commands.ts?

[secustor]

Do you mean?

renovate/lib/workers/repository/update/branch/execute-post-upgrade-commands.ts

Lines 136 to 137 in cde4f00

	// WARNING to self-hosted administrators: always run post-upgrade commands with `shell` mode on, which has the risk of arbitrary environment variable access or additional command execution
	// It is very likely this will be susceptible to these risks, even if you allowlist (via `allowedCommands`), as there may be special characters included in the given commands that can be leveraged here

That should be rather added to the documentation rather code.

[jamietanna]

Few comments, but happy with the overall design and approach - especially as it's very close code wise to how we're doing postUpgradeTasks (which I know is intentional)

[jamietanna]

IMO, let's keep the duplication in place between them - I prefer the "rule of 3" rather than "don't repeat yourself" - there are a few things that are different between them, and we won't know until - maybe - we add a third thing like this where the duplication is and what's special to each case