Skip dependency update when non-bot commits are detected on PR branch

[lbussell]

When the nightly dependency update pipeline runs and an existing update PR already exists (e.g., [nightly] Update dependencies from dotnet/dotnet), the UpdateExistingGitHubPullRequest method replaces the entire PR branch contents with the newly computed state. This overwrites any manual commits that someone may have added to the PR — such as fixups, cherry-picks, or review-related changes.

Changes

Before pushing updated dependency changes to an existing PR branch, we now check whether any commits on the branch were authored by someone other than the bot. If non-bot commits are found:

1. The push is skipped — the PR branch is left as-is.
2. A comment is posted on the PR listing the non-bot commits and providing a dotnet run command that authors can copy-paste to apply the dependency update locally on their branch.

Scope

This affects nightly update PRs for:

• dotnet/dotnet
• dotnet/aspire
• Tools (chisel, syft, rocks-toolbox, mingit)

It does not affect:

• First-time PR creation (no existing PR to check)
• Azure DevOps dependency flows