[FEAT] Add new resource for repository vulnerability alerts

[deiga]

Resolves #3038

---

Before the change?

• Vulnerability alerts for a repository were handled inside the github_repository resource.

After the change?

• Vulnerability alerts for a repository can now be managed in a separate resource
• vulnerability_alerts in the github_repository resource are marked as deprecated

Pull request checklist

• Schema migrations have been created if needed (example)
• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

• Yes
• No

---

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[stevehipwell]

This is looking good.

[stevehipwell]

@deiga could you please rebase?

[stevehipwell]

This looks good, just two minor nits which I think are worth fixing for readability and because I think this resource will be one we can use as an example for people contributing.

[stevehipwell]

This PR looks great, I just have a concern about string matching on an error message (we know errors aren't consistent across GHAS), especially one that isn't explicit about the cause. If we think it's valuable to provide a custom error message, which I'm personally not sure about, then we ought to use the API to get a definitive answer.

[stevehipwell]

LGTM

[robert-crandall]

If the repository is deleted outside Terraform, GetVulnerabilityAlerts will return a 404. The Read function does not check for this and will return an error instead of calling d.SetId("") to remove the resource from state. This breaks terraform plan and terraform apply when the backing repository no longer exists.

Suggested change

	if err != nil {
	return diag.Errorf("error reading repository vulnerability alerts: %s", err.Error())
	}
	if err != nil {
	if resp != nil && resp.StatusCode == http.StatusNotFound {
	tflog.Warn(ctx, "Repository not found, removing from state", map[string]any{"repository": repoName})
	d.SetId("")
	return nil
	}
	return diag.Errorf("error reading repository vulnerability alerts: %s", err.Error())
	}