Fix Renovate not picking up `-N` role tag bumps

The `versioning: loose` package rule matched roles via `matchSourceUrls`.
For `git-tags` dependencies, `sourceUrl` only becomes known after the
datasource lookup, but Renovate resolves the versioning API before that
and never re-resolves it. The rule therefore never applied and roles
fell back to `semver-coerced`, which strips the `-N` suffix, so
`v1.0.0-9` and `v1.0.0-12` compared as equal and no update was offered.

Since the self-hosted runner took over (2026-08-30), only `-0` bumps
have been merged. A local dry-run of renovate 44.61.6 against the
current requirements.yml finds 1 update with the old rule and 9 with
this one (8 of them `-N` bumps).

Same fix as mother-of-all-self-hosting/mash-playbook@a38bae238d7eea364e9c2dbdb788fca095bc47d6
Related to https://github.com/mother-of-all-self-hosting/mash-playbook/issues/3395

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/renovate.json

@@ -54,12 +54,10 @@
   ],
   "packageRules": [
     {
+      "description": "Roles use `vUPSTREAM-N` tags. `sourceUrl` is only known after lookup, so `matchSourceUrls` cannot select the versioning; match the datasource instead",
       "ignoreUnstable": false,
       "versioning": "loose",
-      "matchSourceUrls": [
-        "https://github.com/devture/com.devture.ansible.role{/,}**",
-        "https://github.com/mother-of-all-self-hosting{/,}**"
-      ]
+      "matchDatasources": ["git-tags"]
     },
     {
       "description": "mautrix images are dual-tagged (v0.YYMM.PATCH and vYY.MM[.PATCH]). Stick to the v0 scheme: it matches the git tags (needed for self-building) and has a consistent number of components (the calver tags do not, which makes Renovate stop offering updates).",