fix: use base sha for PRs instead of ref

[43081j]

The ref is a named point, like main, so it can point at a different
target to the PR (e.g. outdated branch).

Using the sha means we diff against the target commit rather than a
named ref.

[github-actions]

⚠️ Duplicate Dependencies (found: 3, threshold: 1)

📦 Package	📋 Versions
@actions/http-client	2 versions @e18e/action-dependency-diff@0.0.1 @actions/github@9.1.1 @actions/http-client@3.0.2 @e18e/action-dependency-diff@0.0.1 @actions/core@3.0.1 @actions/http-client@4.0.0
eslint-visitor-keys	2 versions @e18e/action-dependency-diff@0.0.1 eslint@10.8.0 @eslint-community/eslint-utils@4.9.1 eslint-visitor-keys@3.4.3 @e18e/action-dependency-diff@0.0.1 eslint@10.8.0 eslint-visitor-keys@5.0.1
ignore	2 versions @e18e/action-dependency-diff@0.0.1 eslint@10.8.0 ignore@5.3.2 @e18e/action-dependency-diff@0.0.1 typescript-eslint@8.66.0 @typescript-eslint/eslint-plugin@8.66.0 ignore@7.0.6

💡 To find out what depends on a specific package, run: npm ls example-package