add support for checking transparency in CI

[monperrus]

once a supply chain is made fully transparent, this should be ensured in CI

if dirty-waters finds a high severity warning, we break the build and block the integration in master

[randomicecube]

For future reference (to-self), this refers to the following bullet points

• Dependencies with no link to source code repositories (high severity)
• Dependencies with no tag / commit sha for release, impossible to have reproducible builds (high severity)

[monperrus]

Good suggestion by @AEnguerrand

it is possible to integrate dirty waters, perhaps through a GitHub Action, which could be made available on the marketplace (https://docs.github.com/en/actions/sharing-automations/creating-actions/publishing-actions-in-github-marketplace).

[randomicecube]

FYI, created the repo dirty-waters-action to hold the action. It's still WIP (need to test, etc)