Pin the vendorHash refresh at basecamp/.github's merged revision (#709)

The caller pinned the reusable workflow at the head of its pull request
branch, which the squash merge of basecamp/.github#19 left off main, so
zizmor's impostor-commit audit fails on main. The pin now names the merge
commit, 293dc74, which is the same workflow on the default branch.

Author: jeremy

.github/workflows/dependabot-auto-merge.yml

@@ -48,7 +48,7 @@ jobs:
   refresh-nix-vendor-hash:
     name: Refresh the Nix vendorHash
     if: github.event_name == 'workflow_dispatch' || (github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]') # zizmor: ignore[bot-conditions] -- dual check: actor validates the current trigger (and stops the App bot's own push from looping back), user.login validates PR origin; on:pull_request, not pull_request_target, so GitHub sets the actor from who pushed
-    uses: basecamp/.github/.github/workflows/dependabot-sync-nix-vendor-hash.yml@49eaa2156461cee5ac15c5236d3ff3f5fe900d3f
+    uses: basecamp/.github/.github/workflows/dependabot-sync-nix-vendor-hash.yml@293dc747a2cee44c5b4dae72067adeb681636d26
     with:
       pr: ${{ inputs.pr }}
       # cli-release-bot's client id — the `release` environment's