Add GitHub token to renovate configuration so it can pull release notes

2-nomad-config/renovate.nomad.hcl

@@ -43,12 +43,15 @@ job "renovate" {
       }
 
       # Required SOPS key:
-      #   renovate.gitea_token  — PAT for the renovate bot account in Gitea
+      #   renovate.gitea_token         — PAT for the renovate bot account in Gitea
       #   Create a dedicated 'renovate' user in Gitea with these token scopes:
       #     repo (read+write), user (read), issue (read+write), organization (read)
+      #   renovate.github_token         — read-only GitHub PAT (any account) for
+      #     fetching changelogs and avoiding github.com API rate limits
       template {
         data        = <<EOF
 RENOVATE_TOKEN={{ with nomadVar "nomad/jobs/renovate" }}{{ .gitea_token }}{{ end }}
+RENOVATE_GITHUB_COM_TOKEN={{ with nomadVar "nomad/jobs/renovate" }}{{ .github_token }}{{ end }}
 EOF
         destination = "secrets/renovate.env"
         env         = true