Harden Dependabot workflow conditions (#2384)