Add Dependabot alerts listing support

[Copilot]

Adds support for listing Dependabot alerts across repositories, organizations, and Enterprises, completing the GHAS alert coverage alongside existing secret scanning and code scanning scripts.

Changes

• githubapi.py: Added list_dependabot_alerts() method following the existing alert listing pattern with cursor-based pagination
• list_dependabot_alerts.py: New script with CSV/JSON output, state filtering (auto_dismissed, dismissed, fixed, open), date filtering, and GHES support
• README.md: Added documentation section with usage examples

Output Fields

The script extracts:

• Alert metadata: state, dismissal details, fix status
• Package info: name, ecosystem, manifest path, scope
• Vulnerability data: CVE/GHSA IDs, severity, summary, description
• Version info: vulnerable range, patched version

Usage

# List all open Dependabot alerts for an org
./list_dependabot_alerts.py my-org --state open

# Export last 30 days to JSON
./list_dependabot_alerts.py my-org --since 30d --json > alerts.json

# Repository-level with custom GHES instance
./list_dependabot_alerts.py owner/repo --scope repo --hostname github.example.com

Original prompt

Please add a new script and githubapi.py support for listing Dependabot alerts. The API is documented at https://docs.github.com/en/enterprise-cloud@latest/rest/dependabot/alerts?apiVersion=2022-11-28

Update the README.md to reflect the new script.

Make sure the common functionality in list_secret_scanning_alerts.py and list_code_scanning_alerts.py is implemented.

Created from VS Code via the GitHub Pull Request extension.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.