fix(ci): every Dependabot PR fails on the Codecov upload

[JSONbored]

#9300 (chore(deps): bump fast-uri) fails its test job, and so will every other Dependabot PR.

-> Token length: 0
warning -- Branch `dependabot/npm_and_yarn/fast-uri-3.1.5` is protected but no token was provided
error   -- Commit creating failed: {"message":"Token required because branch is protected"}
==> Failed to run upload-coverage

Cause

validate.yml picks the Codecov path by where the branch lives:

if: github.event_name != 'pull_request' || head.repo.full_name == github.repository   # token
if: github.event_name == 'pull_request' && head.repo.full_name != github.repository   # tokenless

A Dependabot branch is same-repo, so it takes the token path — but pull_request runs triggered
by Dependabot get their own secret scope and cannot read secrets.CODECOV_TOKEN. It resolves to the
empty string, Codecov rejects the protected branch, and fail_ci_if_error: true fails the job.

The condition asks the wrong question. What matters is whether the run can read secrets, not
whether the branch is local. Those coincide for ordinary PRs and forks, and diverge for Dependabot.

Fix

Route Dependabot down the same tokenless path forks already use — the fork path already supplies the
owner:branch prefix that makes Codecov treat a branch as unprotected, which is exactly what a
Dependabot branch needs.

Granting the token in the repo's Dependabot secret scope is the alternative, and is worse: it leaves
the workflow broken by default for anyone who clones it, and silently re-breaks if the setting is
ever lost.

Definition of done

• All four Codecov steps route on secret access, not branch location
• Verified by evaluating each if across main-push / same-repo PR / Dependabot PR / fork PR —
  exactly one path runs per scenario
• chore(deps): bump fast-uri from 3.1.4 to 3.1.5 #9300 goes green without a settings change

[linear-code]

JSO-7412