Needs vulnerability check added to CI

[patmantru]

There should be a vulnerability check in at least one of the CI workflows

[dmihalcik-virtru]

Beyond what happens with dependabot? We maybe want to add one so people don't add vulnerable deps. We can also add some static checking of the code, e.g. with FindBugs or similar