Dependabot fails to upgrade setup-uv from v7 to v8.0.0

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

github-actions

### Package manager version

N/A

### Language version

N/A

### Manifest location and content before the Dependabot update

I'm reporting this from the supplier-side, but there are multiple examples of this linked/cross-referenced in https://github.com/astral-sh/setup-uv/issues/830.

Any `uses:` clause of this form should exhibit the problem:

```
uses: astral-sh/setup-uv@v7
```

(and same with the hash-pinned version, if the version comment is `# v7`.)

### dependabot.yml content

I believe this will happen with any `github-actions` update group in `dependabot.yml`, e.g.:

```yaml
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
```

### Updated dependency

[astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) demonstrates the bug, when (failing to be) upgraded from `v7` (verbatim) to `v8.0.0` (verbatim).

However, I think this bug surfaces more generally when _any_ action goes from a "mutable tag" pattern (e.g. where `vX` points mutably to `vX.Y.Z` to a "fixed tag" pattern (where `vX` no longer exists, and only `vX.Y.Z` tags are created for new releases).

### What you expected to see, versus what you actually saw

I expect Dependabot to correctly issue update PRs for `astral-sh/setup-uv@v7` to `astral-sh/setup-uv@v8.0.0`, including in hash-pinning cases (where both the hash and the version comment should be updated correctly).

https://github.com/astral-sh/setup-uv/issues/830#issuecomment-4230617168 suggests that the underlying source of this bug is Dependabot being overly conservative in how it matches versions: the `v7` and `v8.0.0` have different numbers of version components but _do_ have a sound comparison (`v8.0.0 > v7`), however Dependabot appears to fail to perform that comparison.

### Native package manager behavior

N/A

### Images of the diff or a link to the PR, issue, or logs

See https://github.com/astral-sh/setup-uv/issues/830#issuecomment-4230617168 for additional context.

### Smallest manifest that reproduces the issue

N/A

Start by reproducing the update with an `astral-sh/setup-uv@v7` uses clause and the shown `github-actions` Dependabot configuration, including a hash-pinned variant. Trace the GitHub Actions dependency version matching and update path; done means Dependabot opens the v7-to-v8.0.0 PR and updates both the hash and version comment when pinned.

Written by the indexing model from the issue text.