Allow postUpgradeTasks to "veto" an update

[fschoenm]

Tell us more.

Hello, in my self-hosted instance of renovate, I configured a custom regex manager that allows finding updated dependencies from conan.lock files, together with a postUpgradeTask that calls conan lock upgrade to correctly update the lockfile.

However, due to how Conan lockfiles work, the above approach sometimes finds a newer dependency version than would be supported in the Conan dependency graph. This leads to an invalid PR, which will fail in the CI.

I would like to propose a feature where a postUpgradeTask can "veto" an update if the call fails with an error code. To be backwards compatible, it could feature a new configuration option postUpgradeTask.abortOnFailure or similar, which defaults to false.

I tried to understand the existing code around https://github.com/renovatebot/renovate/blob/main/lib/workers/repository/update/branch/index.ts#L669 and it seems like there are very specific conditions under which the PR doesn't get created (i.e. if the update is below 2h old ...) but most of the time it just creates an invalid PR.