chore: add dependabot changelog automation

Signed-off-by: Steve Hipwell <[email protected]>

Author: stevehipwell

.github/chainguard/actions-pr.sts.yaml

@@ -0,0 +1,5 @@
+issuer: https://token.actions.githubusercontent.com
+subject: repo:action-stars/install-tool-from-github-release:pull_request
+
+permissions:
+  contents: write

.github/workflows/changelog.yaml

@@ -0,0 +1,39 @@
+name: Dependabot Changelog Entry
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled]
+    branches: [main]
+
+permissions: read-all
+
+jobs:
+  changelog:
+    name: Changelog
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 1
+      - uses: octo-sts/action@210248e8ae1ae1550aa6e232c6f192b3ccbf7335
+        id: sts
+        with:
+          scope: ${{ github.repository}}
+          identity: actions-pr
+      - name: Changelog
+        uses: crambl/dependabot-changelog-writer@647c79261a61787aada47de3535b3537cd5ecbc5 # v1.1.4
+        with:
+          push-token: ${{ steps.sts.outputs.token }}
+          commit-message: "chore: Update changelog for Dependabot"
+          changelog: ./CHANGELOG.md
+          section-header: "Changed"
+          changelog-entry-pattern: "Update [dep] from `[old]` to `[new]`. ([pr-link]) _@dependabot_"
+          push-changes: true