fix(investigate): npm alerts route to npm_bump before the dismiss check, so dismiss_unaffected never fires

[toufali]

In scripts/post_alert_action.py, for an unaffected alert the npm-ecosystem branch (action = "npm_bump") is checked before the dismiss_enabled branch. So on npm/yarn repos, unaffected alerts always route to npm_bump and the dismiss branch is unreachable — investigate.dismiss_unaffected: true has no effect for npm alerts.

Fix: check dismiss_enabled (unaffected + low/medium) before falling back to npm_bump.