Add a dependency review workflow for PRs adding new packages

[Marvell69]

Description
Beyond Issue 31's audit gate for existing dependencies, GitHub's native Dependency Review action can flag newly-introduced vulnerable or license-incompatible packages directly on the PR diff, catching issues before merge rather than on a periodic audit schedule.

Requirements and context

• Add .github/workflows/dependency-review.yml using actions/dependency-review-action
• Configure to fail on high-severity new vulnerabilities and disallowed licenses (aligned with Issue 32's allowlist)

Suggested execution

git checkout -b ci/add-dependency-review-action

• Add the dependency review workflow
• Test against a PR intentionally adding a flagged-license package

Example commit message
ci: add GitHub dependency review workflow for new package PRs