chore(ci): use dedicated dependabot org-secret to check out XML submodule (#140)

Author: hf-kklein

.github/workflows/coverage.yml

@@ -15,8 +15,11 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
-          token: ${{ secrets.XML_SUBMODULE_PAT }} # token with repo scope; expires never
+          token: ${{ github.actor == 'dependabot[bot]' && secrets.REPO_AND_READ_PACKAGES_PAT || secrets.XML_SUBMODULE_PAT }}
+          # XML_SUBMODULE_PAT is a secret token on repository level with repo scope; expires in Jan2026
           # https://github.com/Hochfrequenz/xml-fundamend-python/settings/secrets/actions/XML_AHB_MIG_Token
+          # REPO_AND_READ_PACKAGES_PAT is a secret token on organization level
+          # https://github.com/organizations/Hochfrequenz/settings/secrets/dependabot/REPO_AND_READ_PACKAGES_PAT
           submodules: "recursive"
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5

.github/workflows/unittests.yml

@@ -16,8 +16,11 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
-          token: ${{ secrets.XML_SUBMODULE_PAT }} # token with repo scope; expires in Jan2026
+          token: ${{ github.actor == 'dependabot[bot]' && secrets.REPO_AND_READ_PACKAGES_PAT || secrets.XML_SUBMODULE_PAT }}
+          # XML_SUBMODULE_PAT is a secret token on repository level with repo scope; expires in Jan2026
           # https://github.com/Hochfrequenz/xml-fundamend-python/settings/secrets/actions/XML_AHB_MIG_Token
+          # REPO_AND_READ_PACKAGES_PAT is a secret token on organization level
+          # https://github.com/organizations/Hochfrequenz/settings/secrets/dependabot/REPO_AND_READ_PACKAGES_PAT
           submodules: "recursive"
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5