dependabot: auto-merge requires on pull_request_target

[clwluvw]

Why:

Auto-merge appears to function correctly with pull_request_target, allowing it to authenticate and operate within the context of the target repository. Without this, a 401 error is returned due to insufficient scope.

> Run gh pr merge --auto --merge "$PR_URL"
non-200 OK status code: 401 Unauthorized body: "{\r\n  \"message\": \"Bad credentials\",\r\n  \"documentation_url\": \"[https://docs.github.com/rest\](https://docs.github.com/rest/)",\r\n  \"status\": \"401\"\r\n}"

Check off the following:

• A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
• The changes in this PR meet the docs fundamentals that are required for all content.
• All CI checks are passing and the changes look good in the review environment.

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
code-security/tutorials/secure-your-dependencies/automating-dependabot-with-github-actions.md	fpt ghec ghes@ 3.19 3.18 3.17 3.16 3.15 3.14	fpt ghec ghes@ 3.19 3.18 3.17 3.16 3.15 3.14

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[Copilot]

Pull request overview

This pull request proposes changing the trigger event for the Dependabot auto-merge workflow from pull_request to pull_request_target with specific activity types. The PR description claims this change is needed to fix authentication issues (401 errors due to insufficient scope).

Changes:

• Modified the workflow trigger from on: pull_request to on: pull_request_target with types [opened, reopened, synchronize]