Update dependency typing-inspection to v0.4.4 - #461

…ate (#499)

## Problem

Konflux (`red-hat-konflux-kflux-prd-rh02[bot]`) opens automated
dependency-bump PRs against this repo (20 currently open, e.g. #462,
#461, #453) and they get stuck permanently.

`label-gate.yml`'s `check-labels` job requires `lgtm`, `approved`, and
`jira/valid-reference` on every PR, normally applied by openshift-ci
Prow plugins per `OWNERS` files. Verified live against all 20
currently-open Konflux PRs:
- `jira/valid-reference` is missing on **all 20, zero exceptions** —
Konflux PR titles ("Update dependency X to vY.Y.Y") never contain a Jira
key, and nothing ever applies that label for bot PRs.
- `lgtm`/`approved` are applied by openshift-ci most of the time but not
reliably — e.g. #456 was missing `lgtm`, #455 was missing both.

Separately: since Konflux is a GitHub App and not an org collaborator,
its PR runs can hit GitHub's native fork/first-time-contributor
`action_required` gate, where Actions workflows never even execute until
approved.

## Fix

One new, tightly-scoped workflow,
`.github/workflows/konflux-auto-label.yml`:

- Triggers on `pull_request_target` (`opened`, `reopened`,
`synchronize`) — needs write permissions against an external App
identity's PR, which plain `pull_request` wouldn't grant.
- Gated on the **exact** bot login, verified directly against the REST
API before hardcoding it (not assumed): `gh api
repos/osac-project/osac/pulls/462 --jq '.user.login'` returns
`red-hat-konflux-kflux-prd-rh02[bot]` — note this differs from the
`app/red-hat-konflux-kflux-prd-rh02` form `gh pr view --json author`'s
GraphQL-backed output shows. The webhook's `pull_request.user.login`
field (what the `if:` condition actually evaluates against) uses the
REST form, confirmed by checking both the PR and issues API responses
and matching the bot's numeric ID (190377777) across all of them.
- Applies `lgtm`, `approved`, `jira/valid-reference`, `ok-to-test`. All
four labels already exist in the repo (checked via `gh label list`
first) — no label creation needed.
- Approves any pending `action_required` runs for the PR's head SHA,
mirroring `osac-test-infra`'s `slash-command-handler.yml` "Handle
ok-to-test" step (read directly before writing this).
- Uses `secrets.MERGE_QUEUE_TOKEN` (confirmed it already exists in this
repo via `gh secret list`), matching `auto-queue.yml`'s existing pattern
for label/PR mutations — no explicit `permissions:` block, same as
`auto-queue.yml` itself, since all actual mutations go through the token
via `gh`/`gh api`, not the ambient `GITHUB_TOKEN`.
- Scoped to this one specific bot login only — not "any bot" or "any
dependency PR" — per direct instruction. Broadening this needs a
deliberate follow-up decision.
- **SECURITY**: never checks out or executes anything from the PR branch
— only reads trusted `github.event.pull_request.*` context fields and
mutates via the GitHub API, which is what makes `pull_request_target`'s
elevated permissions safe here.

Does not modify `label-gate.yml`, `auto-queue.yml`, or any other
existing workflow — pure addition.

## Verification

- [x] YAML parses (`python3 -c "import yaml; ..."`)
- [x] `actionlint` (no repo Makefile/CI target for it here, so ran the
standalone binary directly) — clean on the new file and on the whole
`.github/workflows/` directory (no regressions)
- [x] Bot login confirmed via live API call, not assumed, on multiple
open PRs (#462, #455) plus a numeric-ID cross-check
- [x] `MERGE_QUEUE_TOKEN` confirmed present via `gh secret list`
- [x] All 4 target labels confirmed already present via `gh label list`
— no creation needed

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added automated handling for eligible pull requests, including labels
indicating review readiness, validation, and testing status.
- Required workflow approvals are processed automatically when
applicable.
- Approval processing continues across all pending workflow runs, even
if an individual approval fails.

- **Security**
- Pull request metadata is evaluated without checking out or executing
code from proposed changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Elior Erez <eerez@redhat.com>