re-introduce dependabot automerge

Was removed in https://github.com/solid-contrib/reactive-authentication/commit/71e132de5fc333341fabbb9a99263498a8faba44 because failing PRs were being merged.

This is because we don't have branch protections setup to block merging on CI failures - the workflow itself is bug free and the same config I use across numerous projects.