Relax dependency review policy

[Boyeep]

Summary

• relax the dependency review policy in .github/dependency-review-config.yml
• remove the strict allow-licenses list
• narrow blocking scope to runtime while keeping fail-on-severity: high
• keep license-check: true so license data is still surfaced without over-blocking normal updates

Why It Changed

• Dependency Review was failing quickly across normal Dependabot PRs
• the strict license allowlist was too noisy for a starter template that spans npm, Python, and GitHub Actions dependencies
• this change keeps the important high-severity dependency guard while making routine update PRs less brittle

Verification

• npm run check:workflows
• npm run check:contract
• npm run check
• npm run check:images if Docker was available

Contract Impact

• no API contract changes
• updated docs/openapi.yaml
• ran npm run api:types
• updated frontend usage of generated types

Screenshots or Notes

• no UI changes
• after merge, re-run or refresh existing Dependabot PRs to confirm Dependency Review is no longer failing on routine dependency updates