chore(deps): Add dependency-review action

[rusackas]

SUMMARY

This PR adds the depedency-review action, which will block PRs that add dependencies to manifests with known vulnerabilities.

See docs for more info: https://github.com/actions/dependency-review-action

EDITS:
• Now configured to only block on high/critical
• Added some Apache incompatible license blocking for good measure.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[codecov]

Codecov Report

Merging #23951 (b6abb90) into master (2a63b39) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master   #23951   +/-   ##
=======================================
  Coverage   68.18%   68.18%           
=======================================
  Files        1941     1941           
  Lines       75241    75241           
  Branches     8158     8158           
=======================================
  Hits        51306    51306           
  Misses      21852    21852           
  Partials     2083     2083           

Flag	Coverage Δ
hive	53.17% <ø> (ø)
javascript	54.49% <ø> (ø)
mysql	78.90% <ø> (ø)
postgres	78.97% <ø> (ø)
presto	53.09% <ø> (ø)
python	82.75% <ø> (ø)
sqlite	77.50% <ø> (ø)
unit	52.98% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[michael-s-molina]

By default, fail-on-severity is set to low. Do we want to fail for this level of vulnerability?

[rusackas]

By default, fail-on-severity is set to low. Do we want to fail for this level of vulnerability?

No we don't! I've set it to high.

There are probably other config options we can look at, like denying certain license types.

[rusackas]

Added some forbidden license types for good measure.