chore: use config file for dep review (#4000)

Author: dnechay

.github/dependency-review-config.yml

@@ -0,0 +1,4 @@
+show-openssf-scorecard: false
+fail-on-severity: 'high'
+allow-ghsas:
+  - GHSA-qwww-vcr4-c8h2 # we don't use vulnerable functionality

.github/workflows/ci-dependency-review.yaml

@@ -16,6 +16,5 @@ jobs:
       - name: Dependency Review
         uses: actions/dependency-review-action@v5.0.0
         with:
-          show-openssf-scorecard: false
-          allow-ghsas:
-            - GHSA-qwww-vcr4-c8h2 # we don't use vulnerable functionality
+          config-file: './.github/dependency-review-config.yml'
+