fix(vulnerabilities): do not force exact patch version in GitHub alerts

[Churro]

Changes

Relaxes the requirement of exact patch versions for security fix PRs that are generated based on GitHub vuln alerts.

istanbul ignore next is used to workaround a types issue with firstPatchedVersion. Due to

renovate/lib/workers/repository/init/vulnerability.ts

Lines 92 to 98 in c3bd354

	if (!alert.securityVulnerability.firstPatchedVersion) {
	logger.debug(
	{ alert },
	'Vulnerability alert has no firstPatchedVersion - skipping',
	);
	continue;
	}

alerts with missing patched versions are skipped early onwards.

Context

• Closes GitHub vulnerability alerts: do not limit to single version #29600
• fix(vulnerabilities): do not force exact patch version in OSV alerts #29666

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

Test repo: https://github.com/renovate-demo/29600-github-vuln-alerts/pulls

[renovate-release]

🎉 This PR is included in version 37.409.1 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)
• 37.409.1

Your semantic-release bot 📦🚀