Configure pinned JS dependencies via updates.config.js (#29696)

Split out from https://github.com/go-gitea/gitea/pull/29684. This
configures the [`updates`](https://github.com/silverwind/updates) module
to exclude these modules for reasons stated in the comments.

updates.config.js

@@ -0,0 +1,6 @@
+export default {
+  exclude: [
+    '@mcaptcha/vanilla-glue', // breaking changes in rc versions need to be handled
+    'eslint-plugin-array-func', // need to migrate to eslint flat config first
+  ],
+};