Auto approve and merge pull requests by Dependabot

[sophia-guo]

Details see adoptium/run-aqa#72. The requirement mainly fits to projects with typescript.

[sophia-guo]

Same requirement for openjdk-test-tools repo. adoptium/aqa-test-tools#372

[llxia]

We need to be very careful with the auto-merge. Some 3rd party lib upgrades will break the code. And I think it may not be a good idea to auto-merge any PR from a bot.

[sophia-guo]

Yes, we need to be careful about the auto merge. However it depends on how we use it. Dependabot will resolve any conflicts with its created PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase. Also note: Dependabot will wait until all your status checks pass before merging. This is a function of Dependabot itself, https://github.com/marketplace/actions/dependabot-auto-merge. We could setup workflows for PRs created by Dependabot ( or could just setup the normal workflow it depends) so auto merge would not work if any status checks fail. Hence no build will be broken.

[llxia]

Talked with Sophia, we may need to evaluate this case by case. For https://github.com/AdoptOpenJDK/openjdk-test-tools, I think we need to create PR builds first. Issue created at adoptium/aqa-test-tools#374

[sophia-guo]

May also extend to PR of github-actions #2319