Released gagen 0.5, which simplifies the output to match dependabot.
I've found maintaining GitHub Actions workflow files is much easier when it's generated from Typescript.
The latest realization is that the output yaml file can act like a lockfile. So I maintain `actions/checkout@v6`, but the generated output gets locked to a hash.
