[BUG] merge_group tigger fails due to different event structure

[ebickle]

Describe the bug
The closed issue #456 stated that support for merge_group was added in the pull request #766. There is potentially a new issue preventing it from working:

[ { "code": "invalid_type", "expected": "object", "received": "undefined", "path": [], "message": "Required" } ]

The PR adds support for the merge_group event (https://github.com/actions/dependency-review-action/pull/766/files#diff-78e13929505c2c55bdac2327ac6c4c9cf471453670a4a648e5f9f64f8e6d8b06) but that's not enough: merge_group event triggers have a significantly different payload structure compared to a pull request.

To Reproduce
Steps to reproduce the behavior:

1. Add a merge_group trigger to a workflow that calls actions/dependency_review_action@v4.3.5. It will always fail.

Expected behavior

• The action should correctly parse the base and ref SHAs from the merge group field.
• In git-refs.ts, line 17 fails because there's no pull_request field in the event. That passes undefined into the schema parser, which fails to validate the input as a an object.

Screenshots
If applicable, add screenshots to help explain your problem.

Action version
4.3.5 (I also noticed v4 isn't pointing to the latest release - not sure if that was intentional)

Examples
If possible, please link to a public example of the issue that you're encountering, or a copy of the workflow that you're using to run the action.

If you have encountered a problem with a specific package (e.g. issue with license or attributions data) please share details about the package, as well as a link to the manifest where it's being referenced.

Additional context

The code likely needs to do the following:

• Move if (context.eventName == 'merge_group') to a separate else if block
• Add a new MergeGroupSchema
• The merge_group field needs to be pulled out of the context. Right now this is done for pull_request in the function declaration, but this starts to get a bit weird if these fields are not always present. May need some refactoring.

•  base_ref = base_ref | merge_group.base_sha
   head_ref = head_ref | merge_group.head_sha
  

[massongit]

I think this is duplicated of #841.

[ebickle]

You're right, thanks!