Add a dependency-review gate to CI (license allow list + known vulnerabilities on pull requests)

`CONTRIBUTING.md`'s Dependencies section (b877fa9) requires that any dependency reaching consumers
carries a license on the allow list published at https://github.com/amazon-ospo/dependency-review-config
and is free of known vulnerabilities. Today that is enforced by review only.

GitHub's [dependency-review-action](https://github.com/actions/dependency-review-action) can fail a
pull request that introduces a dependency violating either rule, on the `pull_request` event, with

```yaml
config-file: amazon-ospo/dependency-review-config/default/dependency-review-config.yml@main
```

To settle when adding it:

- Whether the license check honors `fail-on-scopes` (default `runtime`), so that test-scope
dependencies are not judged against the allow list. The policy asks only that a test dependency's
license permit use in the build (JUnit 4 is EPL-1.0, JMH is GPL-2.0 with the Classpath exception;
both test scope). If it does not, `allow-dependencies-licenses` can list those two packages.
- That the action classifies Maven `test` scope as `development`.
- That Dependabot's own upgrade pull requests pass the gate unchanged.

CI only; no source change.

Start with the Dependencies section of CONTRIBUTING.md and the repository's existing CI workflow configuration. Verify how dependency-review-action handles Maven test scope, the allow-list configuration, and Dependabot pull requests; done means pull requests introducing disallowed licenses or known vulnerabilities fail while valid test dependencies and Dependabot upgrades pass.

Written by the indexing model from the issue text.