feat(dependency-review): add optional GH_AW_GITHUB_TOKEN for label-triggered downstream workflows

[Copilot]

Labels applied via the built-in GITHUB_TOKEN don't re-trigger other workflows (GitHub security model). This adds an optional GH_AW_GITHUB_TOKEN secret so callers can pass an ephemeral token (e.g. GitHub App installation token) for the add-labels safe output, enabling downstream label-event workflows to fire.

Changes

• gh-aw-dependency-review.md — adds GH_AW_GITHUB_TOKEN: required: false to workflow_call.secrets; the compiled lock file already consumed this secret in its fallback chain (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) but it was never passable from the caller
• gh-aw-dependency-review.lock.yml / trigger-dependency-review.yml — regenerated via make compile
• example.yml — commented-out GH_AW_GITHUB_TOKEN secret with usage note
• README.md — new Secrets table documenting both secrets

Usage

jobs:
  run:
    uses: elastic/ai-github-actions/.github/workflows/gh-aw-dependency-review.lock.yml@v0
    secrets:
      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
      GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}  # GitHub App token

[fr4nc1sc0-r4m0n]

LGTM