Automatically merge Dependabot security updates

### What feature you would like to be added?

Add a narrowly scoped automation path that merges Dependabot security-update pull requests after all required checks and repository approval requirements pass.

This must apply only to Dependabot security fixes, not routine version updates. Failed checks, conflicts, major-version changes, or updates requiring manual migration must remain open for maintainer review.

### Why is this needed?

The repository already enables Dependabot for Go modules, Docker, GitHub Actions, and website Python dependencies. Security fixes still require manual merge handling after CI verifies them, which can delay remediation and leave known vulnerabilities present longer than necessary.

Repository labels already include `automerge`, `automerge: exact`, and `dependencies`. A documented, least-privilege workflow can use existing merge policy while preserving branch protection and required reviews.

### Describe the solution you would like

- Detect pull requests authored by `dependabot[bot]` that represent security updates.
- Require all branch-protection checks and required approvals before merge.
- Limit automation to patch/minor security updates with compatible dependency constraints; require manual review for major or breaking updates.
- Use least-privilege GitHub Actions permissions and pin third-party actions by commit SHA.
- Prevent workflow execution with write privileges on untrusted code from the pull request.
- Apply the repository's approved automerge label or enable GitHub auto-merge using the project-standard mechanism.
- Document opt-out and failure behavior.
- Add workflow tests or validation covering non-security Dependabot PRs, failed checks, and unauthorized authors.

### Describe alternatives you have considered

- Continue merging every security update manually. This preserves control but increases remediation latency and maintainer toil.
- Auto-merge all Dependabot updates. This is broader than needed and creates unnecessary compatibility risk.
- Batch updates on a schedule. This reduces noise but can delay urgent security fixes.

### Additional context

Current Dependabot configuration: https://github.com/kubeflow/spark-operator/blob/master/.github/dependabot.yml

Related vulnerability-scanning work: #3069

### Love this feature?

Give it a 👍 We prioritize the features with most 👍

Start by reading .github/dependabot.yml and the repository’s branch-protection and automerge conventions, including the existing automerge labels. Define the workflow or validation entry point around security Dependabot pull requests, then cover non-security updates, failed checks, and unauthorized authors. Done means only eligible patch/minor security updates can merge with required protections, while other cases remain open and opt-out and failure behavior are documented.

Written by the indexing model from the issue text.