Add upstream CVE detection to dependency-cve-monitor workflow

[bhoradc]

Motivation and Context

Enhance the existing dependency-cve-monitor workflow with a new job that detects CVEs directly from upstream sources before they reach the global GitHub Advisory Database.

While we have Dependabot alerts, libraries like Apache HttpComponents have advisories that remain in unreviewed state — meaning Dependabot alerts never fire for them. This is a recent known limitation documented in this GitHub blog
post. This change adds an upstream check for early detection.

Changes

• New check-upstream-advisories job added to dependency-cve-monitor.yml
• Checks Netty and Jackson via GitHub repo-level security advisories API
• Checks Apache HttpComponents via NVD + cve.org (no repo advisories exist for Apache)
• Filters by SDK-used packages and compares patched versions against SDK's current versions
• Sends Slack notification with affected CVEs and recommended upgrade target
• Minor update to existing notify-alerts job: added source attribution and description to Slack message

Detection Sources

Library	Source
Netty	repos/netty/netty/security-advisories
Jackson	repos/FasterXML/jackson-*/security-advisories
Apache	NVD keyword search + cve.org structured data

Testing

Integration tested in a forked repo — validated positive detection (alerts when vulnerable), negative detection (silent when patched), version comparison logic, and PAT access. No new secrets or permissions required.

[github-actions]

This pull request has been closed and the conversation has been locked. Comments on closed PRs are hard for our team to see. If you need more assistance, please open a new issue that references this one.