[repo]: Add opt-in auto-merge for plugin update PRs

[sethwv]

Summary

• Adds .github/workflows/auto-merge-updates.yml, gated behind a new AUTO_MERGE_UPDATES repo variable (off by default).
• When enabled, squash-merges a PR automatically once Validate Plugin succeeds — but only for pure plugin version-bump updates.
• Never merges new plugins, repo/tooling changes, invalid PRs, or PRs that mix a new plugin with an update in the same PR.

How it works

• Triggers on workflow_run completion of Validate Plugin; no-ops unless AUTO_MERGE_UPDATES == 'true'.
• Skips entirely if the GitHub App (GH_APP_ID/GH_APP_PRIVATE_KEY) isn't configured — merging with the plain GITHUB_TOKEN wouldn't cascade into publish-plugins.yml's push trigger, so we never fall back to it for this.
• Resolves the PR by matching head_sha against open PRs (more reliable than workflow_run.pull_requests for fork-originated pull_request_target runs).
• Requires the Plugin Update label; rejects New Plugin, Repo Update, Invalid, or QUARANTINE labels, and requires a clean MERGEABLE state.
• Independently re-derives the same signal from the actual PR diff (touches only plugins/, every touched plugin slug already exists on main) as defense-in-depth against label tampering, rather than trusting labels alone.
• Merges with the GitHub App token specifically so the resulting push is correctly attributed and cascades into publish-plugins.yml.

[dispatcharr-plugins-bot]

This PR is currently a draft. Plugin validation will run once the PR is marked ready for review.