CI: `flake.lock` update job should update the existing PR if an unmerged one exists

That is, if we haven't merged a `flake.lock` PR by the time the job runs again, the job should push to the existing branch, updating the unmerged PR with the latest `flake.lock` changes.

Currently it fails because the branch already exists; instead of failing, it should push to the existing branch.