Add a `postUpdateOptions` for running Sorbet updates

[jamietanna]

Related to #40587, we should provide a means to run:

bundle install

# then
bundle exec tapioca gems --all
bundle exec tapioca dsl
bundle exec tapioca annotations

This would allow users of Sorbet for type checking in Ruby, to be able to receive Renovate PRs that update their compiled types (RBIs).

This would be gated behind allowedUnsafeExecutions, due to it potentially executing malicious code post-upgrade.