Migrate dco-check and vulnerabilityCatcher to Databricks runners (#1327)

## Summary
- Migrate `dco-check.yml` and `vulnerabilityCatcher.yml` from public
`ubuntu-latest` runners to `databricks-protected-runner-group`
- These were the only 2 workflows (out of 22) still using public
GitHub-hosted runners
- Ensures consistent runner security posture across all CI workflows

NO_CHANGELOG=true

## Test plan
- [ ] Verify DCO check workflow triggers correctly on a PR
- [ ] Verify weekly security scan workflow runs on the protected runner
group

This pull request was AI-assisted by Isaac.

Signed-off-by: Gopal Lal <gopal.lal@databricks.com>

Author: gopalldb

.github/workflows/dco-check.yml

@@ -7,7 +7,9 @@ on:
 
 jobs:
   dco-check:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     name: Check DCO Sign-off
     steps:
       - name: Checkout

.github/workflows/vulnerabilityCatcher.yml

@@ -7,7 +7,9 @@ on:
 
 jobs:
   security-scan:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
 
     steps:
       - name: Checkout repository