Tighten Dependabot auto-fix prompt: truthful counts, minimal diffs

[priyanshu92]

Context

The first scheduled run of the Dependabot auto-fix workflow (PR #1559) revealed two prompt-level problems:

1. Inflated alert count. The PR body claimed "33+ open Dependabot alerts (32 moderate, 1 high)", but at the time of the run the Dependabot API only had one open alert (`uuid`, # 172). The count appears to have come from multiplying by the number of transitive `node_modules/**/uuid` occurrences in `package-lock.json` rather than reading the alerts list.
2. Scope creep. The agent reached for `npm audit fix`, which pulled in unrelated bumps: `brace-expansion` and `path-to-regexp` (whose alerts had been auto-dismissed weeks earlier) and ~20 `@fluidframework/*` packages from `2.91.0` → `2.93.0`. The final diff was ~500 lines, vastly larger than the single open alert required.

Changes to the prompt in .github/workflows/dependabot-autofix.yml

1. Alert enumeration is the single source of truth. The agent runs one specific gh api query, persists the output to alerts.json, and builds the PR title + body 1-for-1 from that list. It is forbidden from treating transitive-path occurrences as separate alerts.
2. Strict preference order for fixes: (a) overrides in package.json, (b) direct-dependency bump, (c) parent-package bump only if (a)/(b) are infeasible, and only with a justification in the PR body. npm audit fix / npm audit fix --force are explicitly forbidden.
3. Diff discipline. After regenerating the lockfile, the agent runs git diff --stat origin/main and aborts if package.json touches deps not on the alert list (other than adding overrides), or if any dep crosses a MAJOR version unnecessarily.
4. Structured PR body. Title becomes chore(deps): fix N open Dependabot alert(s) where N matches the alert count. Body has fixed sections: Summary, Alerts addressed (one bullet per alert with the chosen strategy), Collateral changes (or "None"), Verification.
5. Reaffirm no Co-authored-by: trailers (these caused CLA friction on the first run when the bot`s identity was added as a co-author).

Test plan

After merge, trigger the workflow manually via workflow_dispatch and check:

• The count in the PR title matches gh api repos/microsoft/powerplatform-vscode/dependabot/alerts?state=open | jq length.
• The git diff --stat only touches files/packages listed in the alert set, plus justified collateral.
• The PR body has the four required sections and one bullet per alert.