Rulesets using `{{EXTERNALLY_DEFINED}}` report "Update Ruleset" in every dry run

[tdabasinskas]

A ruleset that uses {{EXTERNALLY_DEFINED}} in required_status_checks (support added by #741) shows up as "Update Ruleset" in every dry-run/PR check, even when nothing differs from what's on GitHub.

The cause is an ordering problem in lib/plugins/rulesets.js: changed() runs mergeDeep.compareDeep(existing, attrs) on the raw config, where attrs still contains the literal {{EXTERNALLY_DEFINED}} string. Overrides.removeOverrides (which swaps the placeholder for the live GitHub value) is only called inside update() and add(), after the comparison already decided there's a change — and in nop mode the update() early-return means it's never called at all. The literal placeholder never equals the real status checks, so hasChanges is always true.

Two consequences:

• Every plan and PR comment shows a phantom "Update Ruleset" for these rulesets, which drowns out real changes.
• In apply mode, safe-settings issues a PUT on every sync for these rulesets, writing the same values back.

The branches plugin doesn't have this problem because it resolves overrides inside its comparison (branches.js, the compareDeep call passes the config through Overrides.removeOverrides first). The rulesets plugin needs the same treatment.