Added live cap for Renovate PR creation (#28218)

no ref

Renovate currently has far more than 10 open PRs, but only a small
number are security updates. The overrun is mostly normal dependency
throughput: Renovate's config-level `prConcurrentLimit` /
`branchConcurrentLimit` are useful guardrails, but they are not a live
GitHub-wide open PR cap.

We want scheduled Renovate runs to work down the existing backlog by
rebasing/updating/automerging open PRs, while preventing new normal
dependency PR creation once the live Renovate PR count is at or above
10. Security alert PRs are allowed to continue creating above the cap.