fix(ci): use dependency update app

[lipkau]

Summary

• Use the dedicated dependency-update GitHub App credentials.
• Give JiraPS dependency pull requests an explicit release:none label.
• Add focused tests for credential identity and release intent.
• Reuse the existing CI / test pull-request check for controller validation.

Validation

• actionlint -color (actionlint 1.7.12): passed.
• Import-Module Pester -RequiredVersion 5.7.1 -Force; Invoke-Pester -Path dependency-updates/Tests: 8 passed, 0 failed.
• Import-Module Pester -RequiredVersion 6.2.0 -Force; Invoke-Pester -Path dependency-updates/Tests/ControllerConfiguration.Tests.ps1: 2 passed, 0 failed.
• Invoke-ScriptAnalyzer -Path dependency-updates -Recurse -Severity Warning,Error -EnableExit: passed.
• git diff origin/master --check: passed.

GitHub App verification

Read-only organization and repository queries confirm that atlassianps-dependency-updates is installed, unsuspended, and limited to selected repositories. Its installation permissions are contents write, issues write, pull requests write, workflows write, and metadata read. The controller repository exposes only the dedicated client-ID variable and private-key secret names; no secret values were read or printed.

The current CLI token cannot enumerate the exact selected-repository list. An organization administrator must confirm that the installation includes every target in dependency-updates/targets.json and no unrelated repositories.

Post-merge verification

Do not dispatch the updater for this PR. On the next scheduled dependency update, confirm that any generated pull request is authored by atlassianps-dependency-updates[bot] and receives dependencies plus release:none. This live identity check depends on the merged workflow.

Refs AtlassianPS/AtlassianPS#13