chore(renovate): disable hibernate updates to block replacement PRs

[Naenyn]

Summary

Renovate's config:base built-in replacement rules propose replacing org.hibernate:hibernate-core with org.hibernate.orm:hibernate-core 7.x (see #151). That change cannot build here:

• Hibernate 7 removed the org.hibernate.criterion Criteria API this portlet's DAOs are built on (removed back in Hibernate 5.2).
• Hibernate 7 requires Java 17+, while this portlet builds on Java 11 (the compiler rejects the 7.x class files).

The existing allowedVersions: "< 4.0" rule constrains version updates but does not gate replacement update-types, so the replacement PR slipped through.

Change

Set the existing org.hibernate: / org.hibernate.orm: packageRule to enabled: false. Disabling the package short-circuits all update-types, so both version bumps and replacement PRs are suppressed.

Hibernate 3.6.10.Final is EOL and effectively frozen for this portlet until a coordinated Spring 5+ / Jakarta EE / Java 17 migration, so there is no practical loss from disabling updates entirely.

Notes

• This prevents future noise; the existing replacement PR (Replace dependency org.hibernate:hibernate-core with org.hibernate.orm:hibernate-core 7.4.9.Final #151) should be closed separately.
• Same shape as the earlier renovate-noise-blocking rules in this repo.

[bjagg]

Approving.

Verified before merging:

• renovate.json parses cleanly (5 packageRules).
• Same empirical confirmation as AnnouncementsPortlet #373 — the replacement PR was created despite the allowedVersions cap.
• Nothing lost by disabling: this portlet is on the Hibernate 3.6.x line, long past EOL, so there are no in-line updates to surface.

One note: the org.hibernate: prefix also catches hibernate-validator, pinned here at 4.2.0.Final (2011). That was already effectively frozen — 4.2.0 sits above the old < 4.0 cap, so Renovate had nothing it could propose — so this change doesn't alter its status. Worth knowing that the validator is silently in scope of a rule whose description only mentions ORM, if anyone later wonders why it never gets update PRs.