PRs from dependabot can't access secrets, but can access vars, unlike PRs from forks

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

n/a

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

_No response_

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

Based on #3253, which is designed to prevent a malicious package from abusing dependabot to exfiltrate secrets, secrets are not accessible to dependabot initiated PRs, even though they come from the repo itself and not a fork.

I expected the behavior to be identical to that of a PR from a fork, where neither secrets nor variables are accessible. However, it seems like Dependabot is only blocked from accessing secrets, but variables remain available. While sensible, this is inconsistent with how PRs from forks behave.

From https://github.com/orgs/community/discussions/44088 (reading the issue, not the title), it seems like the intention was that dependabot would be able to access variables; in light of the difference between dependabot's security model and that of forks, was this deliberate?

There's also issues like https://github.com/orgs/community/discussions/44322, which point out that even PRs should have access to variables, but currently, they do not, and I have not seen a clear explanation of why.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Start with the security rationale in #3253 and compare the behavior described for Dependabot and fork pull requests. Read the linked Community discussions for the intended treatment of secrets and variables; done requires a confirmed product decision and clearly documented or consistently implemented behavior.

Written by the indexing model from the issue text.