[2.8] Add dependency review workflow

[vbonk]

What needs to be done

Create .github/workflows/dependency-review.yml using actions/dependency-review-action (SHA-pinned). Runs on PRs, flags new dependencies with known vulnerabilities.

Acceptance Criteria

• Workflow exists with fail-on-severity: moderate
• Comments summary on PR
• SHA-pinned action

[vbonk]

Completed in Phase 2 PR #86.