Repositories might want bots other than dependabot exempted.

[lengau]

My team is moving to renovate, but currently the CLA check blocks these PRs.

I've got a small change that'll allow this (and make the bot list configurable by the repository owner).