feat: [SEC-7263] Add dependency-scan GitHub Actions workflow

[pkaeding]

Summary

Adds a GitHub Actions workflow to generate Software Bill of Materials (SBOM) for Node.js dependencies and evaluate them against security policies as part of SEC-7263.

Requirements

• I have added test coverage for new or changed functionality (N/A - workflow addition)
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions (will be validated in CI)

Related issues

Security ticket: SEC-7263

Describe the solution you've provided

This PR adds a new GitHub Actions workflow (.github/workflows/dependency-scan.yml) that:

1. Generates SBOM: Uses launchdarkly/gh-actions/actions/dependency-scan/generate-sbom@main to create a Software Bill of Materials for all Node.js dependencies
2. Evaluates Policy: Uses launchdarkly/gh-actions/actions/dependency-scan/evaluate-policy@main to check the generated SBOM against LaunchDarkly's security policies
3. Triggers: Runs on pull requests and pushes to the main branch to ensure continuous security monitoring

The workflow follows a two-job pattern where SBOM generation runs first, then policy evaluation depends on the generated artifacts.

Critical items for review

• Artifact passing: Verify that the artifacts-pattern: bom-* in the evaluate-policy job correctly matches the artifacts generated by the SBOM generation step
• Action versions: The workflow uses @main instead of pinned versions - confirm this aligns with security practices
• Workflow triggers: Validate that running on both PR and main branch pushes is appropriate for this repository
• Public action usage: Confirm launchdarkly/gh-actions is the correct action repository for this public repo (vs launchdarkly/common-actions for private repos)

Additional context

This change was implemented as part of a systematic rollout of dependency scanning across LaunchDarkly's npm ecosystem repositories. The workflow uses public GitHub Actions (launchdarkly/gh-actions) since this is a public repository.

Link to Devin run: https://app.devin.ai/sessions/434bb14b7bac4d81b9979b88965be92b
Requested by: @pkaeding

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring