Harden Dependabot auto-merge actor check

github.actor reflects the actor that triggered the run, not the PR
author, so it can read 'dependabot[bot]' on a PR whose code is not
from Dependabot. Gate on the immutable PR author instead, and add a
repository guard so forks that copy this workflow do not auto-merge.

Reported by Volker Dusch (@edorian) and the PHP Foundation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: freekmurze

.github/workflows/dependabot-auto-merge.yml

@@ -9,7 +9,7 @@ jobs:
   dependabot:
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spatie/phpunit-watcher' }}
     steps:
 
       - name: Dependabot metadata