chore(deps): update actions/dependency-review-action action to v3 (#548)

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/dependency-review-action](https://togithub.com/actions/dependency-review-action)
| action | major | `v2.5.1` -> `v3.1.0` |

---

### Release Notes

<details>
<summary>actions/dependency-review-action
(actions/dependency-review-action)</summary>

###
[`v3.1.0`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.1.0):
3.1.0

[Compare
Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.8...v3.1.0)

#### What's New

Added support for dependencies submitted through the [dependency
submission
API](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#best-practices-for-using-the-dependency-review-api-and-the-dependency-submission-api-together).
This includes two new configuration parameters:
`retry-on-snapshot-warnings` and `retry-on-snapshot-warnings-timeout`.

#### What's Changed

- Fix(docs): Correct action input name by
[@&#8203;oerd](https://togithub.com/oerd) in
[actions/dependency-review-action#551

#### New Contributors

- [@&#8203;oerd](https://togithub.com/oerd) made their first
contribution in
[actions/dependency-review-action#551

**Full Changelog**:
actions/dependency-review-action@v3...v3.1.0

###
[`v3.0.8`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.8):
3.0.8

[Compare
Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.7...v3.0.8)

#### What's Changed

Added `on-failure` option to `comment-summary-in-pr` setting by
[@&#8203;sgmurphy](https://togithub.com/sgmurphy) in
[actions/dependency-review-action#540

Previous configuration files using `true`/`false` for
`comment-summary-in-pr` will be mapped automatically to the new values,
but we encourage you to update to `always`/`on-failure`/`never`.

#### New Contributors

- [@&#8203;sgmurphy](https://togithub.com/sgmurphy) made their first
contribution in
[actions/dependency-review-action#540

**Full Changelog**:
actions/dependency-review-action@v3...v3.0.8

###
[`v3.0.7`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.7):
3.0.7

[Compare
Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.6...v3.0.7)

#### What's Changed

- Make GHES support / setup more clear by
[@&#8203;rajbos](https://togithub.com/rajbos) in
[actions/dependency-review-action#534
- Add an option to deny packages or groups of packages by
[@&#8203;adrienpessu](https://togithub.com/adrienpessu) in
[actions/dependency-review-action#544

#### New Contributors

- [@&#8203;rajbos](https://togithub.com/rajbos) made their first
contribution in
[actions/dependency-review-action#534
- [@&#8203;adrienpessu](https://togithub.com/adrienpessu) made their
first contribution in
[actions/dependency-review-action#544

**Full Changelog**:
actions/dependency-review-action@v3...v3.0.7

###
[`v3.0.6`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.6):
3.0.6

[Compare
Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.5...v3.0.6)

Fixes a bug introduced in 3.0.5 where we raised PURL errors when
Dependency Graph returns an empty `package_url`.

###
[`v3.0.5`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.5):
3.0.5

[Compare
Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.4...v3.0.5)

#### What's Changed

Thanks to [@&#8203;theztefan](https://togithub.com/theztefan), we now
have a new `allow-dependencies-licenses` option that takes a list of
dependencies that will be excluded from license checks. See the
[configuration
options](https://togithub.com/actions/dependency-review-action#configuration-options)
for more information on how to use it.

- Exclude dependencies from license checks by
[@&#8203;theztefan](https://togithub.com/theztefan) in
[actions/dependency-review-action#423
- Documentation examples by
[@&#8203;theztefan](https://togithub.com/theztefan) in
[actions/dependency-review-action#423
- Show snapshot warnings in the summary by
[@&#8203;juxtin](https://togithub.com/juxtin) in
[actions/dependency-review-action#439
- Fix default values for fail-on-severity by
[@&#8203;febuiles](https://togithub.com/febuiles) in
[actions/dependency-review-action#451
-   Updated dependencies.

#### New Contributors

- [@&#8203;juxtin](https://togithub.com/juxtin) made their first
contribution in
[actions/dependency-review-action#439
- [@&#8203;theztefan](https://togithub.com/theztefan) made their first
contribution in
[actions/dependency-review-action#423

**Full Changelog**:
actions/dependency-review-action@v3...v3.0.5

###
[`v3.0.4`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.4):
3.0.4

[Compare
Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.3...v3.0.4)

#### What's New?

The Action can now publish a comment in the pull request if the
`comment-summary-in-pr` option is set. More information can be found in
the
[README](https://togithub.com/actions/dependency-review-action#configuration-options).

#### New Contributors

- [@&#8203;davelosert](https://togithub.com/davelosert) made their first
contribution in
[actions/dependency-review-action#393

#### Changelog

- Write Summary as comment to the pull request by
[@&#8203;davelosert](https://togithub.com/davelosert) in
[actions/dependency-review-action#393
- Adjust summary format by
[@&#8203;davelosert](https://togithub.com/davelosert) in
[actions/dependency-review-action#416
-   Security updates.

**Full Changelog**:
actions/dependency-review-action@v3...v3.0.4

###
[`v3.0.3`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.3):
3.0.3

[Compare
Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.2...v3.0.3)

#### What's Changed

- Use cache in check-dist.yml by
[@&#8203;jongwooo](https://togithub.com/jongwooo) in
[actions/dependency-review-action#359
- Fix Dependency Review API response error handling by
[@&#8203;felickz](https://togithub.com/felickz) in
[actions/dependency-review-action#370
-   Security updates

#### New Contributors

- [@&#8203;jongwooo](https://togithub.com/jongwooo) made their first
contribution in
[actions/dependency-review-action#359
- [@&#8203;felickz](https://togithub.com/felickz) made their first
contribution in
[actions/dependency-review-action#370

**Full Changelog**:
actions/dependency-review-action@v3...v3.0.3

###
[`v3.0.2`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.2):
3.0.2

[Compare
Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.1...v3.0.2)

This release fixes spelling errors
[actions/dependency-review-action#348
and upgrades dependencies to fix known vulnerabilities

**Full Changelog**:
actions/dependency-review-action@v3...v3.0.2

###
[`v3.0.1`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.1):
3.0.1

[Compare
Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.0...v3.0.1)

This release contains the following bugfixes:

- Fixing API URL for GHES:
[actions/dependency-review-action#331
- Improve list handling for external config files:
[actions/dependency-review-action#330

**Full Changelog**:
actions/dependency-review-action@v3...v3.0.1

###
[`v3.0.0`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.0):
3.0.0

[Compare
Source](https://togithub.com/actions/dependency-review-action/compare/v2.5.1...v3.0.0)

#### Breaking Changes

By default the action now expects [SPDX-compliant
licenses](https://spdx.org/licenses/) everywhere. If you were previously
using license names in the allow or deny lists make sure they're valid!

#### What's Changed

##### Support for external configuration files

You can now specify a [configuration file external to your
repository](https://togithub.com/actions/dependency-review-action/#configuration-file).
This allows organizations to have a single configuration file for all
their repos.

##### Broader license support

We've added support for a much broader set of project licenses by using
GitHub's [Licenses API](https://docs.github.com/en/rest/licenses).

##### SPDX Compliance

All of our license-related code now expects [SPDX-compliant licenses or
expressions](https://spdx.org/licenses/). This allows us to standardize
on a license naming scheme that already supports `OR`/`AND` expressions.

##### Disable individual checks

You can now use the boolean options `license-check` and
`vulnerability-check` to disable either one of the checks. More
information in [our configuration
options](https://togithub.com/actions/dependency-review-action/#configuration-options).

#### Thanks

Contributors for this release include:

-   [@&#8203;cnagadya](https://togithub.com/cnagadya)
-   [@&#8203;courtneycl](https://togithub.com/courtneycl)
-   [@&#8203;ericcornelissen](https://togithub.com/ericcornelissen)
-   [@&#8203;elireisman](https://togithub.com/elireisman)
-   [@&#8203;hmaurer](https://togithub.com/hmaurer)

Thanks everyone!
**Full Changelog**:
actions/dependency-review-action@v2...v3.0.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/xmldom/xmldom).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4wLjMiLCJ1cGRhdGVkSW5WZXIiOiIzNy4wLjMiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/dependency-review.yml

@@ -24,4 +24,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1
+        uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034 # v3.1.0