Add docs about how to update multitool's lockfile

[mark-thm]

We've added a companion CLI called (creatively) multitool, that supports updating GitHub release based artifacts. In practice this is most of the artifacts we end up working with, and adding support for other, limited artifact sources seems tractable.

In an ideal world, we'll ultimately teach Renovate how to run updates to our lockfile. However, looking at Renovate's support for Bazel artifact updates: Renovate will update GitHub releases, GitHub tags, Go datasources, and docker datasources. This is relatively limited, and our read is that GitHub releases covers the bulk of the artifacts one expects to encounter.

Additionally, we'd like to make it easy to add new tools and more generally to manage the lockfile, and plan to add add, remove, and lint commands to our CLI down the road. We think that'll be useful even if we had full Renovate support.

In addition to describing that the CLI exists, this PR includes sample GitHub Actions to use within one's repo. Publicly, one can see the download-and-execute example in rules_uv.

Partial solution to #28.