Add OWASP Dependency Checker to the GH CI workflows

[dlg99]

Motivation

Detect CVEs early and make them visible to the committers

Modifications

Added GH workflow that will fail if new CVE with level > 7 detected. The plan is to not treat it as blocking merge.
Currently some projects that will not pass the check and aren't included into the suppressions for variety of reasons are excluded.

Verifying this change

• Make sure that the change passes the CI checks.

This change is a trivial rework / code cleanup without any test coverage.

Does this pull request potentially affect one of the following parts:

If yes was chosen, please highlight the changes

• Dependencies (does it add or upgrade a dependency): (yes / no)
• The public API: (yes / no)
• The schema: (yes / no / don't know)
• The default values of configurations: (yes / no)
• The wire protocol: (yes / no)
• The rest endpoints: (yes / no)
• The admin cli options: (yes / no)
• Anything that affects deployment: (yes / no / don't know)

Documentation

Check the box below or label this PR directly (if you have committer privilege).

Need to update docs?

• doc-required

  (If you need help on updating docs, create a doc issue)

• no-need-doc

  (Please explain why)

• doc

  (If this PR contains doc changes)

[dlg99]

/pulsarbot run-failure-checks

[dlg99]

/pulsarbot run-failure-checks

[lhotari]

LGTM

[eolivelli]

Great stuff.
But I left one comment.

[eolivelli]

Why running this check on every pull request?
New dependencies are added very seldom.
If a dependency is flagged there will be much noise.
People usually add a new dependency using the latest available version.

I suggest to run this only periodically, like every day and manually on every active release branch

[lhotari]

@eolivelli this is only run when one of the pom.xml files is modified.

[lhotari]

in addition there's the existing job to run periodically

[dlg99]

@eolivelli as Lari said, it runs only on changes in pom files, see:

      - name: Detect changed pom files
        id: changes
        uses: apache/pulsar-test-infra/paths-filter@master
        with:
          filters: |
            poms:
              - 'pom.xml'
              - '**/pom.xml'

[eolivelli]

Thanks for your clarifications

Lgtm

[nicoloboschi]

+1, great work

[hpvd]

+1