ci(security): park dependency-review until Dependency graph is enabled

The action fails without the repository Dependency graph, which requires
org admin access to enable. New-dependency vulnerabilities remain gated
by npm audit --omit=dev in ci.yml; the job definition is kept as a
comment for easy restoration.

Author: liuxuezhuo

.github/workflows/security.yml

@@ -28,14 +28,19 @@ jobs:
       - name: Analyze
         uses: github/codeql-action/analyze@a2983b8bed1923f44751c5c43237f479442827b3 # v3
 
-  dependency-review:
-    name: Dependency review
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - name: Review dependency changes
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+  # actions/dependency-review-action requires the repository's Dependency
+  # graph to be enabled (Settings > Code security and analysis). Until an
+  # org admin enables it, newly introduced vulnerabilities are still gated
+  # by the "npm run audit:prod" step in ci.yml. To restore this job:
+  #
+  # dependency-review:
+  #   name: Dependency review
+  #   if: github.event_name == 'pull_request'
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+  #     - name: Review dependency changes
+  #       uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
 
   secrets:
     name: Secret scan