Keep automatic GitHub Packages credentials proxy-only

[JamieMagee]

What changed

Mark automatically generated GitHub Packages credentials as proxy-only. They are sent to the credentials proxy with their secrets, but omitted from updater credentials-metadata, so Dependabot Core cannot interpret them as registry-routing configuration.

The Action now also:

• creates host-wide Maven/Gradle and NuGet fallback credentials, allowing cross-owner package access grants;
• keeps path-scoped explicit credentials alongside the host-wide fallback;
• suppresses the fallback only when an explicit host-wide credential already exists;
• preserves the existing feature flag and supported ecosystem list.

This addresses the Action side of dependabot/dependabot-core#15415.

Dependency

Do not merge yet. This depends on dependabot/proxy#229. After that PR publishes a proxy image, this branch must update docker/Dockerfile.proxy, regenerate docker/containers.json and dist/, and rerun validation.

Rollout checklist: github/dependabot-api#8820.

Validation

• Full non-integration Jest suite: 153 passed, 17 skipped
• npm run typecheck
• npm run lint-check
• npm run format-check
• reproducible npm run package with Node 24.13.0