[StepSecurity] Apply security best practices (#44)

## Summary

This pull request is created by
[StepSecurity](https://app.stepsecurity.io/securerepo) at the request of
@jasonkarns. Please merge the Pull Request to incorporate the requested
changes. Please tag @jasonkarns on your message if you have any
questions related to the PR.
## Security Fixes

### Add Dependency Review Workflow

The Dependency Review Workflow enforces dependency reviews on your pull
requests. The action scans for vulnerable versions of dependencies
introduced by package version changes in pull requests, and warns you
about the associated security vulnerabilities. This gives you better
visibility of what's changing in a pull request, and helps prevent
vulnerabilities being added to your repository.

- [Github Guide about Dependency
Review](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review)
- [Github Guide for Configuring Dependency Review
Action](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-dependency-review#using-inline-configuration-to-set-up-the-dependency-review-action)


## Feedback
For bug reports, feature requests, and general feedback; please email
support@stepsecurity.io. To create such PRs, please visit
https://app.stepsecurity.io/securerepo.


Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

---------

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Co-authored-by: Jason Karns <jason.karns@gmail.com>

.github/workflows/test.yml

@@ -35,6 +35,15 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
         BASH_EXEC_IGNORE_LIBRARIES: true # superlinter bug
 
+  dependency-review:
+    if: startsWith('pull_request', github.event_name)
+    runs-on: ubuntu-latest
+    steps:
+    - uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+      with: {egress-policy: audit}
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+    - uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1
+
   ossf-scorecard:
     if: github.ref_name == github.event.repository.default_branch
     permissions: {id-token: write, security-events: write}