Auto-merge ruby-builder-bot PRs

[flavorjones]

This PR is trying to drive the conversation from https://bugs.ruby-lang.org/issues/21804.

I don't think that it's a good idea to auto-merge on a project so critical in the Ruby supply chain. For a foundational action that runs across thousands of CI pipelines, the blast radius of a bad merge is huge.

Auto-merge might be reasonable, but only if it’s tightly scoped to low-risk, mechanically generated changes with strong guardrails (which this PR has tried to do); but if ruby-builder-bot gets compromised then it's game over for the Ruby supply chain.

Pros:

• Faster propagation of routine updates (e.g., version lists, metadata bumps) without maintainer latency.
• Less maintainer toil on high-frequency bot PRs.
• More consistent update cadence and fewer stale PRs.

Cons:

• Single-point-of-failure risk: a compromised bot or supply-chain attack can push a bad change quickly to many downstream users.
• Reduced human review on changes that may have subtle security or correctness impacts.
• Harder to detect abuse if tests can be manipulated or if the update surface grows over time.