ci: fix spoofable bot condition

github.actor can be spoofed and shouldn't be used to check whether the
PR author is a trusted bot. For more info, see:
https://docs.zizmor.sh/audits/#bot-conditions

.github/workflows/dependabot.yml

@@ -10,7 +10,7 @@ jobs:
     permissions:
       contents: write # Required to merge PR
       pull-requests: write # Required to enable auto-merge for PR
-    if: github.actor == 'dependabot[bot]'
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
       - name: Fetch Dependabot metadata
         id: metadata