CI: add lockfile update action to manually trigger for dependabot PRs

[superlopuh]

I tested it here and it works if you do the dumb thing and trigger on push, but it seems to not run actions on unsigned commits by default. I'm hoping that if we trigger the action manually it'll inherit the clicker's permissions and re-run the action. In either case, I think whatever we adopt should supercede the cron job one as we want to never be out of sync between the pyproject and lockfile.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.75%. Comparing base (91c2790) to head (4d5cc34).
Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3647      +/-   ##
==========================================
- Coverage   90.75%   90.75%   -0.01%     
==========================================
  Files         467      467              
  Lines       58905    58905              
  Branches     5639     5639              
==========================================
- Hits        53460    53458       -2     
- Misses       4001     4002       +1     
- Partials     1444     1445       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[alexarice]

So this needs to be manually run on dependabot prs?

[superlopuh]

For now, yes

[superlopuh]

Stop-gap until this beast is merged: dependabot/dependabot-core#10040