ci: only run vulnerability scan only when requirements are modified

ci: only run vulnerability scan only when requirements are modified #1793