ci: auto-merge Dependabot patch-level security updates

[acamarata]

Enables automatic merging of Dependabot patch-level security updates (approved by the repo owner).

Scope — deliberately narrow

Auto-merges only when both are true:

1. update-type == version-update:semver-patch
2. Dependabot reports a GHSA advisory id (i.e. it is a security update)

Minor, major, and non-security patch bumps are not auto-merged and still need a human.

Why

Five repos hit the same failure in a single day: an audit/SBOM gate turning red from a freshly published advisory. Patch security updates are the class that is both urgent and low-risk enough to land unattended; letting them queue up is what produced the backlog.

Safety properties

• Uses gh pr merge --auto — this does not merge immediately. GitHub queues it and completes only once all required status checks pass. A red build blocks it exactly as for a human PR.
• No admin override anywhere — branch protection is fully respected.
• Does not check out the PR code. pull_request_target runs with repository write scope, so checking out and executing untrusted PR code would be a privilege-escalation hole. This job only reads metadata and calls the API.