Allow LGPL-3.0 for sonarqube-scan-action in dependency review

[AndreasIgel]

Summary

• Adds a scoped allow-dependencies-licenses exception for pkg:githubactions/SonarSource/sonarqube-scan-action, whose LGPL-3.0 license is outside the fail-closed allow-licenses allowlist.
• The action only executes the scanner on the runner — use of an unmodified tool, not distribution or a derivative work — so LGPL obligations do not apply.
• The exception purl is deliberately version-less: dependency-review-action's matcher ignores the version component, and it is the usage as a CI action that makes the license unproblematic.
• The strict allow-licenses policy is unchanged for all other dependencies (including Maven artifacts, where LGPL genuinely matters).

Context

This unblocks the dependency-review check on #285, which introduces SonarSource/sonarqube-scan-action in fork-sonar.yml. Since this workflow runs on pull_request_target, the exception is read from the base branch — it must merge to main before #285's check can go green (re-run the failed job after merging).

Test plan

• After merge, re-run the failed dependency-review job on Stop executing fork-controlled Maven in the privileged fork Sonar workflow (#232) #285 and confirm it passes

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!