Document dependabot PR handling to ensure they don't end up in the changelog

[alyssadai]

We use the omit-commits auto plugin to exclude bot PRs from the changelog:

https://github.com/neurobagel/workflows/blob/94563cc33f46920c280649d51581b27bb013c79e/template_configs/.autorc_default#L12-L17

However, when we merge a bot PR using a merge commit instead of squashing, we can end up with a situation where not all commits from the PR are associated with the bot. As a result, the PR as a whole might still end up in the changelog.

Example: https://github.com/neurobagel/annotation-tool/releases/tag/v0.4.5

Solutions:

• Squash rather than merge commit where ever possible
• Ensure that dependabot[bot] is an author in the commit message (usually the default)
• We can make dependabot add the skip-release label to all PRs