Define shared policy for dependency update and auto-merge workflows

[vitormattos]

Parent: #15
Related: #6, #20

Goal

Define the LibreCode policy for dependency-update, approval and auto-merge workflows before deciding whether they belong in the shared catalog.

Decisions

• only explicitly recognized dependency bots may be auto-approved;
• patch/minor updates may be eligible for auto-merge after required checks;
• major updates require human review unless a repository documents a narrower exception;
• security remediation must not bypass required checks;
• approval and merge remain independently auditable;
• GitHub App credentials are preferred over personal/bot PATs;
• pull_request_target workflows must verify the actor and must not execute untrusted PR code with write credentials;
• external Actions remain pinned to full commit SHAs;
• repository-specific Dependabot/Renovate/PAT behavior stays local rather than being centralized just to reduce YAML duplication.

Current workflow decisions

• dependabot-approve-merge.yml: keep the existing Extract implementation local until it satisfies the shared actor and credential model.
• npm-audit-fix.yml: keep repository-local; remediation PR creation must not imply automatic approval/merge.
• obsolete Nextcloud OCP auto-merge workflows are not migrated.

The complete policy is documented in docs/dependency-update-policy.md.

Implemented in #60.