Sonar fails with 401 for non team-member PRs

[zhumin8]

https://github.com/googleapis/sdk-platform-java/actions/runs/11821753764

Error:  Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:5.0.0.4389:sonar (default-cli) on project gapic-generator-java-root: Error status returned by url [https://api.sonarcloud.io/analysis/jres?os=linux&arch=x86_64]: 401 -> [Help 1]

similar issue saw in GoogleCloudPlatform/spring-cloud-gcp#3376

[zhumin8]

later runs of sonar workflow has no issue:
https://github.com/googleapis/sdk-platform-java/actions/runs/11823259150
Maybe flaky?

[jinseopkim0]

SonarCloud Build / Build (pull_request) failed for the same reason for all renovate bot PRs for sdk-platform-java.
e.g.
#3285

https://api.sonarcloud.io/analysis/jres?os=linux&arch=x86_64 in the error message links to a page with the following message:
{"Message": "User is not authorized to access this resource with an explicit deny"}

[zhumin8]

I think these sonar failures may not be flaky, but rather as @jinseopkim0 pointed out is related to access setup.
Observed that all renovate bot PRs fail on 401, also on PRs raised by non team member. e.g. https://github.com/googleapis/sdk-platform-java/actions/runs/12643422744/job/35229377267

Not sure if there are security concerns around this setup.