dependabot pullrequests fail in `SonarCloud QA` check

When dependabot creates a new pull-request, the checks are started, which is good.
The check for `SonarCloud QA` fails.

**To Reproduce**
* Wait for a new dependabot pr.
* Or look at the looks of recent one, e.g. #7096. It fails, check the logs and search for "ALM".
* Or trigger a rerun of elder checks where the logs have been purged meanwhile, e.g. as done in #6716 .

**Expected behavior**
`SonarCloud QA` should run correctly.

The check status should be green (if all other checks and the `sonarcloud qa` one has acceptable results from the scan.

**Analysis**
Somehow this process does not gain the same permissions as pull-request by maintainers.

For an example of the log messages and the difference between a successful and failing run, see messages in #6716.

Start by comparing the failed SonarCloud QA logs from #7096 with the successful and failing runs described in #6716, focusing on the permissions available to Dependabot pull requests. Trace the CI entry point that launches SonarCloud QA and verify the check completes successfully with acceptable scan results for a new Dependabot pull request.

Written by the indexing model from the issue text.