workflows/vendor-gems: fail PRs with out-of-sync vendored gems.

Also fix the dependabot conditional: `user.login` is `dependabot[bot]`,
not `dependabot`, so the checkout/commit/push steps were silently
skipped on dependabot PRs (e.g. #22059 merged with its lockfile ahead
of the vendored gems).