Fix YAML linting issues in dependency-review workflow

[Copilot]

Addresses YAML linting violations and security best practices in the dependency review workflow configuration.

Changes:

• Quoted on key as "on": for YAML parser compatibility
• Normalized branches array to ["main"] (removed excess whitespace)
• Fixed indentation of commented configuration options to align with active keys under with: block
• Pinned action references to immutable commit SHAs with release tag annotations:
  • actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
  • actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

Before:

on:
  pull_request:
    branches: [ "main" ]
    
steps:
  - uses: actions/checkout@v4
  - uses: actions/dependency-review-action@v4
    with:
      comment-summary-in-pr: always
    #   fail-on-severity: moderate

After:

"on":
  pull_request:
    branches: ["main"]
    
steps:
  - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
  - uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261  # v4.8.2
    with:
      comment-summary-in-pr: always
      # fail-on-severity: moderate

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/checkout/releases
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)
• https://api.github.com/repos/actions/dependency-review-action/releases
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}