Automate successful Dependabot updates

[Andrew-S-Rosen]

What changed

Adds a GitHub Actions workflow that enables squash auto-merge for Dependabot pull requests after the existing tests workflow completes successfully.

Safety

• Verifies the pull request author is dependabot[bot].
• Verifies the successful workflow run tested the pull request's current head commit.
• Uses GitHub auto-merge so any remaining branch-protection requirements are still enforced.
• Grants only contents: write and pull-requests: write to the trusted workflow_run job.

Validation

• Confirmed repository auto-merge and squash merging are enabled.
• Confirmed the existing tests workflow runs for pull requests.
• Confirmed this branch is one commit ahead of main with only the new workflow file.