Try out dependency review GHA workflow

[jmbowman]

GitHub has created a GitHub Action for dependency change reviews; here is further documentation for it. This looks like it could help us avoid some types of problems with software license incompatibility and security vulnerabilities with minimal effort. Try it out on one repository owned by Arbi-BOM (maybe api-doc-tools?) as an experiment to determine if we want to use it more broadly.

A/C:

• A workflow and configuration file are added to the chosen repo to run the dependency review check on all new PRs. Adding to an existing workflow instead of creating a new one is fine if that's simpler and has negligible impact on CI duration.
• A PR created to add a dependency with an inappropriate license fails the new check.
• A PR created to add a dependency with a known security vulnerability fails the new check.