Add dependabot auto merge workflow

[eliihen]

Adds new reusable workflow that allows automatically merging PRs from dependabot that matches given patterns.

Example usage in .github/workflows/auto-merge.yml:

name: Dependabot auto-merge
on: pull_request_target

jobs:
  auto-merge-dependabot:
    permissions:
      id-token: write
      contents: write
      pull-requests: write
    uses: kartverket/github-workflows/.github/workflows/auto-merge-dependabot.yml@add-dependabot-merge

Example configfile in .github/auto-update.json:

[{
  "match": {
    "dependency_name": "hashicorp/google",
    "update_type": "semver:minor"
  }
}, {
  "match": {
    "dependency_name": "hashicorp/google-beta",
    "update_type": "semver:minor"
  }
}]

See working example in https://github.com/kartverket/gcp-service-accounts/pull/402.

Requires usage of newer branch rulesets (NOT older branch protection rules) so that one can exclude octo-sts from the rule and it can merge the PR.

[martinhny]

pretty cool!