Add Dependency Review workflow

[mattt]

From the docs:

Dependency review lets you catch insecure dependencies before you introduce them to your environment, and provides information on license, dependents, and age of dependencies.

This PR adds a new workflow that runs the Dependency Review on pull requests.