feat(renovate): use our containers if possible

This allows us to use the containers from `common-ci-tasks-images` for
packages we build those for.

Only match then in `.tool-versions` so the version from
`.tool-versions.build` in the `common-ci-tasks-images` are still
getting updates from upstream.

renovate-common.json

@@ -324,6 +324,12 @@
       ],
       "groupName": "terraform-provider-google"
     },
+    {
+      "matchFiles": [".tool-versions"],
+      "description": "packages that we have our own docker images for should use those instead of upstream",
+      "matchDepNames": ["shellcheck", "shfmt"],
+      "replacementNameTemplate": "registry.gitlab.com/gitlab-com/gl-infra/common-ci-tasks-images/{{{packageName}}}"
+    },
     {
       "description": "Group all common-ci-task updates together. Keep this near the bottom for higher priority.",
       "matchSourceUrlPrefixes": [