UpdateManagerUpdate doesn't need to use the renderer service

Problem/Motivation

Discovered at #1538118: Update status does not verify the identity or authenticity of the release history URL...

\Drupal\update\Form\UpdateManagerUpdate::buildForm() is currently doing this:

    $last_markup = [
      '#theme' => 'update_last_check',
      '#last' => $this->state->get('update.last_check', 0),
    ];
    $form['last_check'] = [
      '#markup' => \Drupal::service('renderer')->render($last_markup),
    ];

A) Not properly injected renderer service.

However, more to the point:

B) Pre-rendering this is silly -- the form is a giant render array, already.

Steps to reproduce

Visually inspect core/modules/update/src/Form/UpdateManagerUpdate.php and search for 'renderer'.

Proposed resolution

Don't pre-render, and let $form['last_check'] remain a render array until the form itself is rendered.

Remaining tasks

1. Do it.
2. Reviews / refinements.
3. RTBC.
4. Commit.

User interface changes

Nope.

API changes

None.

Data model changes

N/A

Release notes snippet

Nope.