ci: Use DEPENDABOT_AUTH for dependabot-triggered Sonar scans

Dependabot-triggered runs read the Dependabot secret store rather than
the Actions one, so `secrets.SECRET_AUTH` resolves to an empty string.
The sonar-scanner action then fails to authenticate with Secret Manager
and cannot load the github-token secret, surfacing as the misleading
`Missing env var: GITHUB_TOKEN`.

Select DEPENDABOT_AUTH only when dependabot is the actor, leaving every
human-authored run on SECRET_AUTH unchanged.

Evidence this is actor-scoped rather than code-scoped: on a single
dependabot commit, commit-msg, pre-commit and the ASVS gate all pass and
only CI fails -- it is the one workflow that reads the secret. Rebasing
or recreating those PRs cannot help, since both preserve dependabot as
the triggering actor.

Author: thced

.github/workflows/pull_request.yaml

@@ -31,4 +31,7 @@ jobs:
           sonar-host: https://sonarcloud.io
           sonar-scanner: maven
           main-branch: master
-          service-account-key: ${{ secrets.SECRET_AUTH }}
+          # Dependabot-triggered runs read the Dependabot secret store, where
+          # SECRET_AUTH does not exist. Fall back to the Dependabot-scoped key
+          # for those runs only.
+          service-account-key: ${{ github.actor == 'dependabot[bot]' && secrets.DEPENDABOT_AUTH || secrets.SECRET_AUTH }}