allow testing watch-dependencies workflow

[minrk]

The watch-dependencies workflow has elevated permissions and is protected by the github actions environment watch-dependencies-env. This means it cannot be tested.

To allow testing PRs to watch-dependnecies, we should:

1. add pull_request trigger in watch-dependencies.yaml
2. split the workflow into two jobs:
3. figure out all the updates and produce outputs (no environment no credentials)
4. second job that only makes the PR, with environment: watch-dependencies-env and if: not a PR, using the previous job's outputs