Add actions/dependency-review-action

[martincostello]

Changes

Add a GitHub Actions workflow that checks the licenses of dependencies, amongst other things.

Once merged, if I rebase #146 it should detect the incompatible license.

Merge requirement checklist

• Unit tests added/updated
• CHANGELOG.md file updated for non-trivial changes
• Changes in public API reviewed (if applicable)

[Copilot]

Pull Request Overview

This PR adds a GitHub Actions workflow to perform dependency license reviews, ensuring that only dependencies with approved licenses are used.

• Introduces a new workflow file for dependency review triggered on pull requests to the main branch
• Configures the checkout and dependency-review steps with pinned versions for reproducibility

Comments suppressed due to low confidence (1)

.github/workflows/dependency-review.yml:7

• [nitpick] Consider adding a comment clarifying the intent behind the empty global permissions block to help future maintainers understand that this is intentional for reducing the workflow's access scope.

permissions: {}

[matt-hensley]

Ignoring OATs warning for now

[martincostello]

Ignoring OATs warning for now

Yeah, I'll look into this later. Maybe it also explains why I was unexpectedly getting failures in #150 too.