ci: Update merge conflict labeler

[QuLogic]

PR summary

This should fix the warning about deprecated nodejs.

Also, changing from the branch name to a tagged commit should be more stable, and I think will fix dependabot to start auto-updating this one.

PR checklist

• [n/a] "closes #0000" is in the body of the PR description to link the related issue
• [n/a] new and changed code is tested
• [n/a] Plotting related features are demonstrated in an example
• [n/a] New Features and API Changes are noted with a directive and release note
• [n/a] Documentation complies with general and docstring guidelines

[QuLogic]

Note also that this won't have any effect here because it runs on the pull_request_target trigger, and that doesn't use the PR contents for security reasons. But you can see this action running on my fork at https://github.com/QuLogic/matplotlib/actions/runs/8560979186

[tacaswell]

I assume using the hash for paranoia reasons?

[QuLogic]

Yes, @matthewfeickert did this elsewhere for us in #26025.

[matthewfeickert]

There's no real downside to using the hash, but for the record I generally only care about using it when it comes to supply chain security. I'll defer to you all on if https://github.com/eps1lon/actions-label-merge-conflict is critical enough to your infrastructure that it needs hashes or not (they will get autoupdated by Dependabot either way).

[QuLogic]

It's not super privileged, but it does have PR write permissions.