feat: add dependency review action

[saidsef]

Problem Statement:
Currently, our workflow lacks automated security scanning of dependency changes in pull requests. This leaves us vulnerable to potential supply chain attacks and the introduction of known vulnerabilities through dependencies.

Proposed Solution:
Implement GitHub's Dependency Review Action to automatically scan dependency changes in pull requests. This will:

• Flag known vulnerabilities in dependencies
• Alert on malicious packages
• Identify dependency version changes
• Block merges if critical security issues are found

Action Items:

1. Add dependency review workflow:

name: 'Dependency Review'
on: [pull_request]

permissions:
contents: read
pull-requests: write

jobs:
dependency-review:
runs-on: ubuntu-latest
steps:
- name: 'Checkout Repository'
uses: actions/checkout@v4
- name: 'Dependency Review'
uses: actions/dependency-review-action@v4

2. Configure policy settings:

• Set severity levels for blocking
• Define allowed/denied licences
• Configure vulnerability alerts

3. Update documentation:

• Add details to security policy
• Update contributor guidelines
• Document remediation process

4. Test implementation:

• Create test PR with known vulnerable dependency
• Verify blocking behaviour
• Validate alert formatting

Dependencies:

• GitHub Advanced Security licence
• Repository access permissions
• Branch protection rules enabled

[github-actions]

👋 Hi and Thanks for Reporting!

[saidsef]

This was resolved by #180