fix: detect Dependabot security PRs by cross-checking alerts, not body text

[ianmcburnie]

Summary

• The auto-merge workflow's is_security check grep'd the PR body for literal GHSA-/CVE- strings, but Dependabot doesn't reliably include those in every security-update PR body — so some security bumps get silently skipped by auto-merge instead of merged.
• Found this while porting the same workflow's fix over from a sibling repo, where none of several genuine security-fix PRs (confirmed against open Dependabot alerts) had a GHSA/CVE string in the body.
• Now the bumped package name is parsed from the PR title and cross-checked against the repo's actual open Dependabot alerts via the API.
• Also added a few retries around the merge step to ride out the brief window where branch protection hasn't caught up with the just-completed CI run yet.

Test plan

• Confirm the next Dependabot security PR (e.g. one of the currently open alerts: brace-expansion, form-data, js-yaml, qs, request, smol-toml, tar, tough-cookie, uuid) gets correctly detected and auto-merged