Renovate auto merging MRs with failed pipeline

Discussed in https://github.com/renovatebot/renovate/discussions/46225

When Renovate turns on GitLab auto-merge, it waits until the MR is mergeable and has a pipeline. It accepts a failed pipeline and doesn't check that the pipeline belongs to the MR's latest commit.

If Renovate has just pushed and GitLab hasn't created a pipeline for that commit yet, PUT /merge with merge_when_pipeline_succeeds=true has no pipeline to wait for. Without "Pipelines must succeed", GitLab then merges straight away. The failed pipeline on the MR belongs to the previous commit. You should see a Renovate push in the MR activity shortly before the merge.

Workaround: enable Merge checks > Pipelines must succeed, or set "platformAutomerge": false.

The fix on our side is for tryPrAutomerge to require pipeline.sha === sha before enabling auto-merge.