Support post-update commands to regenerate files after dependency bumps

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Feature description

# Feature request: support post-update commands to regenerate files after dependency bumps

## Problem

When Dependabot bumps a dependency that affects generated files (e.g. running `npm run build` produces different output after a version change), those generated files are not updated in the Dependabot PR. The standard workaround is a workflow that runs the build and pushes the result back to the PR branch:

```yaml
- run: npm run build
- run: |
if [[ -n "$(git status --porcelain)" ]]; then
git add .
git commit -m "chore: update generated files"
git push origin HEAD:${{ github.head_ref }}
fi
```

However, this runs into a fundamental limitation: [pushing with `GITHUB_TOKEN` does not retrigger workflow runs](https://docs.github.com/en/actions/concepts/security/github_token#when-github_token-triggers-workflow-runs). As a result, required CI checks never run on the updated commit, and the PR cannot be merged.

All known workarounds require either a PAT or a GitHub App to perform the push with a non-`GITHUB_TOKEN` identity — which may not be available due to organization security policy. Other attempted workarounds (closing/reopening the PR, dispatching workflows explicitly) are equally suppressed when done via `GITHUB_TOKEN`.

## Requested feature

Support a `post-update-commands` option in `.github/dependabot.yml` (similar to what [Renovate supports natively](https://docs.renovatebot.com/configuration-options/#postupgradetasks)) that allows specifying shell commands Dependabot itself runs before opening the PR:

```yaml
version: 2
updates:
- package-ecosystem: npm
directory: "/"
schedule:
interval: weekly
post-update-commands:
- npm run build
```

Start with .github/dependabot.yml and the documented npm example; trace how post-update commands would run before a pull request is opened and how generated changes would be included. Done means the option is accepted and commands execute before PR creation without relying on a GITHUB_TOKEN push, with the behavior covered by the project's tests.

Written by the indexing model from the issue text.