Harden auto-merge selection, SHA pinning and compatibility scan

Address review feedback on the auto-merge workflow.

Selection now matches only the two exact titles "Update OpenAPI 3.0
Descriptions" and "Update OpenAPI 3.1 Descriptions" for both candidates
and superseded pull requests, so unrelated bot pull requests can never be
closed. The logic moves out of inline jq into
.github/scripts/select_openapi_prs.py so it can be unit tested, and a
title is only allowed to supersede its older siblings when its own newest
pull request was successfully pinned. Each superseded pull request is
re-checked for state, author and title immediately before it is closed.

Every step now works from the head commit SHA captured at selection time:
check runs, merge-freeze content reads, fetch, file extraction and merge.
The merge step re-reads headRefOid for all candidates and aborts safely if
any moved. A mutable branch name is never used to obtain validated
content.

The compatibility scanner is rewritten as a recursive, $ref-aware
comparison that walks properties, array and tuple items,
additionalProperties, allOf/oneOf/anyOf and operation parameters, and
applies asymmetric request and response rules. Traversal is memoised on
resolved node identity so shared schemas are compared once. The module
docstring states the known limits rather than implying full coverage.

Also adds checks: read and issues: read to the workflow permissions, unit
tests for selection, SHA pinning and compatibility cases, a workflow to
run those tests, and __pycache__/ to .gitignore. GHES freeze behaviour is
unchanged apart from reading content at the pinned SHA.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: shawnHartsell