ci: add Dependency Review Action to block vulnerable dependency changes

gstack ships dependency-bearing manifests (package.json, bun.lock) but has
no pull-request gate that blocks newly introduced known-vulnerable
dependencies. A PR can currently add or bump an npm/Bun dependency with no
CI check against advisories.

Add a Dependency Review workflow using GitHub's official
actions/dependency-review-action, which diffs the dependency graph
(base...head) on each pull request and fails when a change introduces a
dependency with a high or critical advisory. The threshold is documented
inline and easy to tighten to moderate/low.

Matches existing workflow house style (ubicloud-standard-8 runner, version-
tagged actions, minimal contents:read permissions). Validated with
actionlint 1.7.12 (the same linter run by .github/workflows/actionlint.yml):
no issues.

Fixes #1987

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/dependency-review.yml

@@ -0,0 +1,19 @@
+name: Dependency Review
+# Blocks pull requests that introduce dependencies with known vulnerabilities.
+# Uses GitHub's Dependency Graph to diff base...head, so it only runs on PRs.
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubicloud-standard-8
+    steps:
+      - uses: actions/checkout@v4
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          # Fail the check when a PR adds a dependency with a high or critical
+          # advisory. Lower the threshold to `moderate`/`low` to tighten.
+          fail-on-severity: high