chore(deps): update urfave/cli/v3 to v3.9.0 (#37863)

Updates `github.com/urfave/cli/v3` to
[v3.9.0](https://github.com/urfave/cli/releases/tag/v3.9.0) and removes
the renovate pin now that
[urfave/cli#2319](https://github.com/urfave/cli/pull/2319) (the `-c`
help flag parsing fix) is merged.

v3.9.0 prepends the default command name to the root command's args,
which broke the old `Root().Args()` check in `isValidDefaultSubCommand`.
It now uses the command's own `Args()`.

Behavior change: `./gitea web <extra-positional-arg>` now errors with
`unknown command` instead of starting the web server and ignoring the
trailing arg. `web` takes no positional args, so this is stricter (and
arguably more correct) input handling. The intended `./gitea bad-cmd`
rejection is unchanged.

---
This PR was written with the help of Claude Opus 4.7

---------

Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: Nicolas <bircni@icloud.com>

cmd/main_test.go

@@ -41,4 +41,5 @@ func TestDefaultCommand(t *testing.T) {
 	test(t, []string{"./gitea"}, "", true)
 	test(t, []string{"./gitea", "test"}, "", true)
 	test(t, []string{"./gitea", "other"}, "other", false)
+	test(t, []string{"./gitea", "test", "extra"}, "extra", false)
 }