[Security Slam 26] Achievement 2 - Create Dependency Management Policy (DEPENDENCIES.md) #10063

Is there an existing issue already for your request/idea?

• I have searched for an existing issue, and could not find anything. I believe this is a new documentation enhancement to be evaluated.

What problem in the existing documentation this issue aims to solve?

As part of our participation in the Security Slam 26, we need to formalise our dependency management practices. This is a direct requirement for the Chronicler badge and is necessary to satisfy the dependency-management-policy field in our SECURITY-INSIGHTS.yml file.

Under the OSPS Baseline (OSPS-DO-06.01), a project at our maturity level must provide a descriptive statement of how we select, obtain, and track our dependencies to ensure supply chain integrity.

Describe what additions need to be done to the documentation

• Create DEPENDENCIES.md: Add a new document to the root of the repository outlining our dependency management policy.

Describe what pages need to change in the documentation, if any

No response

Describe what pages need to be removed from the documentation, if any

No response

Additional context

No response

Backport?

Yes

Code of Conduct

• I agree to follow this project's Code of Conduct