Use correct SHA for pull request events

In a pull request, GITHUB_SHA is set to the "last merge commit on the GITHUB_REF branch".
This isn't the correct value to use when generating a dependency graph.
This changes to use the value of `pull_request.head.sha`, which is the correct
value for a dependency graph.

Fixes #882

package.json

@@ -39,6 +39,7 @@
     "@actions/http-client": "2.1.1",
     "@actions/tool-cache": "2.0.1",
     "@octokit/rest": "19.0.13",
+    "@octokit/webhooks-types": "7.3.0",
     "string-argv": "0.3.2"
   },
   "devDependencies": {
@@ -52,7 +53,7 @@
     "eslint-plugin-jest": "27.4.0",
     "eslint-plugin-prettier": "5.0.0",
     "jest": "29.7.0",
-    "js-yaml": "4.1.0", 
+    "js-yaml": "4.1.0",
     "patch-package": "8.0.0",
     "prettier": "3.0.3",
     "ts-jest": "29.1.1",