fix: pin dependabot/fetch-metadata action to immutable SHA

[BunsDev]

Motivation

• The pull_request_target workflow granted contents: write and pull-requests: write, but it executed dependabot/fetch-metadata@v2 (a mutable tag) which creates a supply-chain risk if that action tag is compromised, so the action must be pinned to an immutable reviewed commit SHA.

Description

• Replace the mutable uses: dependabot/fetch-metadata@v2 with the reviewed full commit SHA in /.github/workflows/dependabot-auto-merge.yml (uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0) while preserving the existing pull_request_target trigger, permissions, and merge behavior.

Testing

• Verified the workflow now references a full 40-character SHA using a small Python regex check which succeeded.
• Ran git diff --check which reported no trailing-whitespace or patch errors and succeeded.

---

Codex Task

[Copilot]

Pull request overview

This PR reduces GitHub Actions supply-chain risk in the Dependabot auto-merge workflow by pinning dependabot/fetch-metadata to an immutable commit SHA while keeping the existing pull_request_target permissions and merge gating behavior intact.

Changes:

• Replace dependabot/fetch-metadata@v2 with a full 40-character commit SHA (08eff52…) annotated as v2.4.0.
• Preserve the workflow’s existing trigger (pull_request_target), permissions, and security-update-only merge condition.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.