No notice on Medium severity RBAC misconfiguration

[mcandre]

CodeQL never emails me about missing permissions blocks in GitHub Actions. There's a message hidden away in the security tabs.

Unlike Dependabot, I never get an email about my impacted repositories.