CLOUDP-458268: Dedup Dependabot Jira tickets across re-runs (#313)

* CLOUDP-458268: Dedup Dependabot Jira tickets across re-runs

The ticket/comment/label steps were gated on github.event.pull_request.labels,
which is frozen at run-creation time. A re-run replays that payload, never sees
the auto_close_jira label the first attempt added, and files another ticket
(atlas-local-lib#190: 3 attempts -> 3 tickets).

Gate on the PR's current comments (the 'was created for internal tracking'
marker close-jira already reads) instead, and add a per-PR concurrency group so
the opened/synchronize runs serialize rather than race past the guard.

* remove comment

CLOUDP-436967: absorb atlas-cli fix version into _dependabot-jira (#252)

mongodb-atlas-cli owns dependabot-create-jira-issue.yml, which does the
same work as the synced dependabot-jira.yaml on the same trigger and
guard. Left in place both would file a ticket per dependabot PR, and
close-jira.yml takes head -1 of the matching comments, so the second
ticket would never be closed.

The only behaviour that workflow has and the reusable one lacks is the
next-atlascli-release fix version, so pick that up per repository. Its
go.mod team routing is not a real difference: all 59 entries in
library_owners.json map to apix-devtools and library_owners_jira.json
maps that to 22223, which the reusable workflow already hardcodes.

Removing the repo-owned workflow is a separate change in
mongodb-atlas-cli, since sync only deletes files carrying the generated
marker.

CLOUDP-436967: consolidate dependabot auto-merge into _dependabot-jira (

#251)

Fold the approve and auto-merge steps from dependabot-auto-merge.yaml
into the reusable _dependabot-jira.yaml workflow, and drive every
GitHub API call with the APIx bot app token instead of GITHUB_TOKEN.

Actions taken by GITHUB_TOKEN do not trigger further workflow runs, so
the comment and auto_close_jira label added under that token never woke
the close-jira workflow. That is why dependabot Jira tickets stayed open
after their PRs merged.

The app id and secret now come from 1Password alongside the existing
Jira credential, so the workflow no longer depends on per-repo
APIXBOT_APP_ID / APIXBOT_APP_PEM secrets being configured in every
target repository.

Since nothing in the reusable workflow uses GITHUB_TOKEN any more, its
permissions drop to {} and the caller's grant is removed.

The mongodb/mongodb-atlas-cli sync target is carried over from the
deleted workflow so the automation is not dropped from that repo.

feat: allow to pass owner and repos to create-github-app-token (#136)

fix: find-jira can't find anything (#40)

fix: multiline (#31)

feat: add comment-jira action (#30)

* feat: add comment-jira action

* fix

* test

* fix

fix: create-jira action to set exit code (#29)

chore: add error details in create-jira action (#13)

* chore: add error details in create-jira action

* fix

* fix

fix: support base ref default for shallow clones (#9)