Fix outdated Dependabot PR token claim in workflow-runs-dependabot-note

The reusable states that workflow runs triggered by Dependabot pull requests "run as if they are from a forked repository" with a read-only GITHUB_TOKEN that "cannot access any secrets". This contradicts the Dependabot troubleshooting article, which states that the permissions key can increase the token's access, and the "Permissions for forked repositories" section on the same workflow-syntax reference page, which scopes the write-to-read downgrade to pull requests from forked repositories only. It also contradicts the Dependabot/fetch-metadata README, whose auto-approving example relies on this exact pattern.

Follow-up to #37657, which addressed other parts of this contradiction.

Author: Marrrrrrrrry

data/reusables/actions/workflow-runs-dependabot-note.md

@@ -1 +1 @@
-Workflow runs triggered by {% data variables.product.prodname_dependabot %} pull requests run as if they are from a forked repository, and therefore use a read-only `GITHUB_TOKEN`. These workflow runs cannot access any secrets. For information about strategies to keep these workflows secure, see [AUTOTITLE](/actions/reference/security/secure-use).
+By default, workflow runs triggered by {% data variables.product.prodname_dependabot %} pull requests use a read-only `GITHUB_TOKEN`. You can use the `permissions` key in your workflow to increase the access for the token. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions). For information about strategies to keep these workflows secure, see [AUTOTITLE](/actions/reference/security/secure-use).