chore(CI): upgrade dependency-review-action to v5 and retry on snapshot warnings

[basvandijk]

The dependency-review job in .github/workflows/security-checks.yml
compares the dependency snapshot of a PR's base commit against the one of
its head commit. The head snapshot is submitted by the job itself, but the
base snapshot comes from a different workflow run, so it is occasionally
not there yet when the comparison runs. The action then sees zero base
dependencies, reports the entire crate tree (1346 packages) as newly added,
and fails on advisories that already exist on master.

That is what happened in this run:

The number of snapshots compared for the base SHA (0) and the head SHA (1)
do not match. You may see unexpected additions in the diff.
...
Cargo.Bazel.toml.lock » mio@0.8.10 – Mio's tokens for named pipes may be
delivered after deregistration (high severity)
##[error]Dependency review detected vulnerable packages.

mio@0.8.10 was not introduced by that PR — it is unchanged on master, and
the PR did not touch Cargo.Bazel.toml.lock at all. Re-running the very same
job later succeeded
with zero additions and no vulnerabilities, without any change to the code
under test.

Changes

• Set retry-on-snapshot-warnings: true so the action waits for the base
  snapshot to show up instead of failing on a comparison it already knows is
  incomplete. Note the accompanying retry-on-snapshot-warnings-timeout
  defaults to 120s, which is left as-is.
• Bump the action from v4.9.0 to v5.0.0. That major release only moves the
  runtime from node20 to node24; no inputs were renamed or removed. It also
  silences the deprecation warning the old pin emitted, since node20 actions
  are already being forced onto node24 by the runner. v5.0.0 requires
  Actions Runner >= v2.327.1, which the GitHub-hosted runners satisfy.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the dependency-review GitHub Actions workflow to reduce flaky failures caused by missing base dependency snapshots at comparison time, and to keep the workflow aligned with the latest supported runtime for the upstream action.

Changes:

• Upgrade actions/dependency-review-action from v4 to v5.0.0 (pinned by commit SHA).
• Enable retry-on-snapshot-warnings: true to wait for the base snapshot instead of comparing against an incomplete (zero-snapshot) baseline.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.