dependency-review posts benign 'missing snapshots' warning; submit Maven dependency snapshots #212

Problem

The dependency-review check passes (green ✅) but posts a "Snapshot Warnings: No snapshots were found for the head SHA ..." block in the PR comment on every PR.

Root cause: this Maven project's dependency graph is populated only by GitHub's static pom.xml parsing (manifest-based). No dependency submission snapshots exist, so dependency-review-action emits the snapshot warning even though it falls back to the manifest graph and still passes.

The retry-on-snapshot-warnings: true option added in #182 is counterproductive here: with no submission workflow, it makes every run retry for ~2 min waiting for a snapshot that never arrives, then proceeds with the warning anyway.

Fix

• Add a dependency-submission.yml workflow (Maven dependency submission action) on push to main, which submits the full transitive dependency snapshot to the dependency graph. This improves vulnerability detection (transitive deps, not just declared ones) and gives main real snapshot data.
• Remove retry-on-snapshot-warnings from dependency-review.yml.
• Document that the head-SHA snapshot warning on fork PRs is expected/benign — a fork PR head cannot get a submitted snapshot without building untrusted fork code with a write token, which we deliberately avoid.

Follow-up to #160 / #182.