A security engineer is onboarding a newly imported private repository into the organization's Supply Chain Security program. They want Dependabot alerts to notify maintainers when a dependency has a known vulnerability. After navigating to the repository's security settings, they find the Dependabot alerts toggle is greyed out and cannot be enabled. What must be enabled first to unblock this configuration?