feat: [SEC-7263] Add dependency-scan GitHub Actions workflow

[pkaeding]

feat: SEC-7263 Add dependency-scan GitHub Actions workflow

Summary

Adds automated dependency scanning and license policy evaluation as part of LaunchDarkly's security initiative SEC-7263. This workflow generates Software Bill of Materials (SBOM) for Node.js dependencies and evaluates them against security policies.

Key changes:

• New .github/workflows/dependency-scan.yml with two jobs: SBOM generation and policy evaluation
• Configured for Node.js dependency scanning only
• Runs on all pull requests and pushes to main branch
• Uses private repository workflow pattern with launchdarkly/common-actions

Review & Testing Checklist for Human

• Verify workflow permissions: Test that the workflow runs without "Unable to resolve action" or 403 permission errors when accessing launchdarkly/common-actions
• Validate SBOM generation: Check that generated SBOM artifacts contain expected Node.js dependencies from package.json/package-lock.json
• Test policy evaluation: Confirm the evaluate-policy job correctly processes SBOM files and reports any license violations or security issues
• Confirm repository type: Verify that Node.js-only scanning (types: 'nodejs') is appropriate - check if this repo contains Go, Python, or other language dependencies that should also be scanned

Recommended test plan: Create a test PR to trigger the workflow and verify both jobs complete successfully with proper SBOM artifacts generated.

Notes

• This is part of the broader SEC-7263 security initiative to implement dependency scanning across all LaunchDarkly npm ecosystem repositories
• Workflow uses pinned SHA for security: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e
• Requested by Patrick Kaeding (@pkaeding)
• Link to Devin run: https://app.devin.ai/sessions/434bb14b7bac4d81b9979b88965be92b

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring