Dependabot lock files (OI-060)

[arunshivab]

Dependabot lock files (OI-060)

Release: none · Answers: SGM-503, ASVS V14.2.1

Dependabot's NuGet pull requests update only the lock files of projects that reference a package directly, so locked
restore fails with NU1004 in projects that get the package through another project (#47). This workflow regenerates
every lock file on Dependabot's NuGet branches and pushes them back, so those pull requests restore and run CI.

• Runs only for pull requests Dependabot opened and pushed, from this repository's dependabot/nuget/ branches.
• Runs dotnet restore --force-evaluate and nothing else (no build, no tests); refuses to push anything but
  packages.lock.json files; confirms locked restore passes before pushing.
• Pushes with a deploy key (LOCKFILE_DEPLOY_KEY, write access to this repository only), because a push with the
  built-in token would not start CI again. The branch name reaches the script only through an environment variable.
• Checked against Bump the nuget-minor-and-patch group with 2 updates #47's branch: locked restore went from 18 NU1004 errors to none; 9 lock files changed, nothing else.
• actionlint clean. Docs: dependency scanning, threat model, go-live checklist, CHANGELOG (Unreleased).