Add auto-merge workflow for Scala Steward and Dependabot PRs

[xerial]

Summary

Auto-merge dependency update PRs once the required CI checks pass. Adapted from wvlet/wvlet's auto-merge.yml.

• Scala Steward: this repo's Steward PRs are opened under the xerial account, because Steward runs with that account's token. The job therefore matches author == xerial and a head branch starting with update/, so other PRs from that account are not auto-merged. PRs labeled semver-spec-major or early-semver-major have auto-merge disabled.
• Dependabot: non-major updates only, using dependabot/fetch-metadata.
• Merging directly when checks have already passed: GitHub refuses gh pr merge --auto on a PR whose checks are already green ("clean status"), so the workflow falls back to a direct gh pr merge. Branch protection still applies.
• Built-in token: uses GITHUB_TOKEN instead of a GitHub App token. Merges made with it don't trigger other workflows, so snapshot.yml won't run after an auto-merge. The next manual merge to main publishes the snapshot.
• Dependabot grouping: all GitHub Actions updates now come as a single PR. When several Dependabot PRs edited the same workflow file, merging the ones left behind main failed with refusing to allow a GitHub App to create or update workflow ... without 'workflows' permission (seen in xerial/scala-steward-repos).

Test plan

• The next Scala Steward PR gets auto-merge enabled and merges after CI
• A major-update Steward PR stays open

💎 Generated with Treasure Work