fix: authorize Dependabot alert reads

Author: msukkari

.github/workflows/vulnerability-triage.yml

@@ -68,6 +68,7 @@ permissions:
   contents: read
   packages: read
   security-events: read # Required for CodeQL alerts API
+  vulnerability-alerts: read # Required for Dependabot alerts API
   id-token: write # Required for OIDC authentication
 
 jobs:
@@ -143,7 +144,7 @@ jobs:
         id: check
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT }}
+          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT || secrets.GITHUB_TOKEN }}
         run: |
           HAS_ALERTS=false
 
@@ -194,7 +195,7 @@ jobs:
       - name: Write alerts summary
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT }}
+          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT || secrets.GITHUB_TOKEN }}
         run: |
           echo "## Dependabot & CodeQL Alert Check" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
@@ -287,7 +288,7 @@ jobs:
 
       - name: Fetch Dependabot alerts
         env:
-          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT }}
+          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT || secrets.GITHUB_TOKEN }}
         run: |
           if [ -z "$DEPENDABOT_PAT" ]; then
             echo "::warning::DEPENDABOT_PAT not configured. Writing empty Dependabot alerts."