ci: fix PR token permissions and gate dependency review

.github/workflows/ci.yml

@@ -17,6 +17,7 @@ concurrency:
 
 permissions:
   contents: read
+  pull-requests: read
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
@@ -25,7 +26,8 @@ env:
 
 jobs:
   dependency-review:
-    if: github.event_name == 'pull_request'
+    # Enable only when repository security analysis supports dependency review.
+    if: github.event_name == 'pull_request' && vars.ENABLE_DEPENDENCY_REVIEW == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     continue-on-error: true