Check who opened the pull request before auto-merging it

The Dependabot auto-merge job ran when github.actor was
dependabot[bot]. zizmor (bot-conditions) flags that as spoofable: the
actor is whoever caused the event, so a run Dependabot triggers on a
pull request someone else opened passes the check, and the job then
approves the pull request and enables auto-merge.

The job now checks github.event.pull_request.user.login, the author of
the pull request, which is the condition GitHub's own documentation
for Dependabot auto-merge uses. dependabot/fetch-metadata still checks
the author and that the commits are Dependabot's before anything is
approved.

Author: abashev

.github/workflows/dependabot-automerge.yml

@@ -9,7 +9,9 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
+    # Who opened the pull request, not who triggered this run: github.actor is whoever caused the event,
+    # and a run that Dependabot triggers on someone else's pull request would pass an actor check.
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
       - name: Fetch Dependabot metadata
         id: metadata