Add dependency review workflow

[m-ringler]

Description

This PR sets up dependency review action to avoid introducing vulnerabilities and incompatible licenses.
See actions/dependency-review-action: A GitHub Action for detecting vulnerable dependencies and invalid licenses in your PRs.

Type of change

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

This PR.

Checklist:

• I followed the Contributing Guidelines.
• I did a self-review.
• I commented my code, particularly in hard-to-understand areas.

[codecov]

Codecov Report

Merging #34 (2e1a4aa) into main (41bac9f) will not change coverage.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #34   +/-   ##
=======================================
  Coverage   77.64%   77.64%           
=======================================
  Files          58       58           
  Lines        1897     1897           
  Branches      121      121           
=======================================
  Hits         1473     1473           
  Misses        401      401           
  Partials       23       23           

Components	Coverage Δ
czicompress	66.75% <ø> (ø)
czishrink	80.39% <ø> (ø)

[DaveyJonesBitPail]

I think it may be reasonable to have different sets of permissible/compatible licenses for different parts of the codebase.

Additionally, Wix uses a MS-RL which is more stringently copy-left if we were to use portions of their code (just generating an installer with the toolset is fine and not a concern) then we would be breaking this current set.

[m-ringler]

I think it may be reasonable to have different sets of permissible/compatible licenses for different parts of the codebase.

Not sure about that. I think our code should be

• licensable under MIT for czicompress
• licensable under GPL for czishrink
• usable in proprietary/closed-source code/products by ZEISS (with attribution) in its entirety as required by the CLA

The common denominator of that would be to allow dependencies with permissive, non-copy-left open source licenses compatible with the GPL.

Additionally, Wix uses a MS-RL which is more stringently copy-left if we were to use portions of their code (just generating an installer with the toolset is fine and not a concern) then we would be breaking this current set.

I‘d say: let’s discuss changes to the admissible licenses when and where they become necessary. Whether we want to allow MS-RL code in the repository or not feels a bit off-topic to me, here. This PR is about the mechanism of dependency license checking, not about which licenses we want to allow.

[DaveyJonesBitPail]

We may want to relax the fail-on-severity but I'm happy with keeping it at the default "low" until it becomes a problem