Dependency Review fails every PR when the Dependency graph is disabled: a repository setting no commit can fix #112

Problem

In a repository generated from the template whose Dependency graph is switched off, Security / Dependency Review fails on every pull request. The graph is off by default for private repositories, and it is off in the public konard/medical-neural-network-ml. The error is Dependency review is not supported on this repository, and no commit can fix it. That is a false positive for the PR author: their change is fine, a repository setting is not.

Root cause

.github/workflows/security.yml L70-L88 calls actions/dependency-review-action@v5 unconditionally. The action needs the Dependency graph (docs).

Suggested fix

This is what konard/medical-neural-network-ml already does (scripts/check-dependency-graph.sh):

1. Check the setting first. GET /repos/{owner}/{repo}/dependency-graph/sbom: only a definite 404 means "disabled".
2. On pull requests, a disabled graph is a ::warning:: that names the setting, and the review step is skipped.
3. On push to main and on the schedule, it fails with the exact setting to change:

Dependency graph is disabled for <owner>/<repo>, so dependency review cannot run. A repository admin must enable it: https://github.com/<owner>/<repo>/settings/security_analysis -> Dependency graph -> Enable.

So the PR stays green while main fails loudly with the human action, which is the pattern hive-mind best practice #17 asks for.

Found while comparing the files in konard/medical-neural-network-ml#5.