Trigger dep-bump resolution on merge request pipeline failures

What does this MR do and why?

The dependency-bump breaking-change resolution flow was never triggered for merge-request pipeline failures.

DependencyManagementSubscriptions#dependency_bump_mr_failure? filtered failed pipelines on pipeline.ref. For merge-request pipelines, ref is the internal MR ref (e.g. refs/merge-requests/7/head), not the source branch — so the dependency-management/ prefix check never matched and TriggerResolveDependencyBumpWorkflowWorker was never enqueued. Only failures on branch pipelines (whose ref is the source branch) got through.

This is the common case: projects that run CI on merge-request pipelines ($CI_PIPELINE_SOURCE == "merge_request_event") have passing branch pipelines and a failing MR pipeline — exactly the pipeline that was being filtered out. The workflow therefore never ran and the auto-generated dependency-bump MRs were left with broken pipelines.

The fix filters on pipeline.source_ref, which resolves to the MR source branch for merge-request pipelines and falls back to ref for branch pipelines — covering both pipeline types. It is a strict superset of the previous behaviour, so branch-pipeline failures continue to trigger as before.

References

• Related to #606046 (closed)
• Introduced in !243891 (merged)

How to set up and validate locally

This requires setting up of profiles locally which is not feasible, test cases covers this case.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.