Add workflow to auto-merge Auspice bump PRs

[victorlin]

Description of proposed changes

The auto-merge is reasonable because the target branch is deployed to the canary site (next.nextstrain.org), not the production site. Auto-merge allows us to test the latest Auspice release on the canary site without manually merging the automatically created version bump PRs.

Changes outside of this PR

• [x] Regenerated [org secret] GH_TOKEN_NEXTSTRAIN_BOT_REPO and renamed as [org Actions+Dependabot secret] GH_TOKEN_NEXTSTRAIN_BOT_REPO
• [x] Created a new organization Dependabot secret on named GH_TOKEN_NEXTSTRAIN_BOT_REPO with the regenerated value
• [x] Updated the value of the existing organization Actions secret with the same name
• [x] Added dependabot/fetch-metadata@* as an allowed GitHub action on @nextstrain.

Related issue(s)

Prompted by Slack discussion.

Testing

• [x] Auto-merge was successful through manual testing on my personal fork repo (PR, run). Dependabot will wait for CI to pass then merge.
• [x] Post-merge: new job is skipped on non-dependabot PRs (can't test this until the workflow exists in master)

[victorlin]

Failing test seems transient – it passed on the merged commit.

[joverlee521]

Just made an Auspice release for the first time since this workflow was implemented! It totally worked as expected 🎉

The only hiccup I ran into was the deploy job did not have access to our Heroku secrets because the GH Action was triggered by dependabot. I've added the Heroku secrets to the Dependabot secrets and the latest run is working as expected.