fix: patch-up support for merge_group (#43)

* feat(dependency-review): default base-ref, head-ref when no pull_request trigger
https://coveord.atlassian.net//SEARCHAPI-10328

* feat(dependency-review): more flexible approach
https://coveord.atlassian.net//SEARCHAPI-10328

.github/workflows/dependency-review.yml

@@ -16,6 +16,16 @@ on:
         required: false
         default: on-failure
         type: string
+      base-ref:
+        description: Provide custom git references for the git base
+        required: false
+        default: ${{ github.event.pull_request.base.sha }}
+        type: string
+      head-ref:
+        description: Provide custom git references for the git head
+        required: false
+        default: ${{ github.event.pull_request.head.sha }}
+        type: string
 
 jobs:
   dependency-review:
@@ -26,7 +36,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Checkout licenses
-        uses:  actions/checkout@v4
+        uses: actions/checkout@v4
         with:
           repository: coveo/dependency-allowed-licenses
           path: coveo-dependency-allowed-licenses
@@ -58,3 +68,5 @@ jobs:
           comment-summary-in-pr: ${{ inputs.comment-summary-in-pr }}
           fail-on-severity: high
           config-file: ./coveo-dependency-allowed-licenses/${{ steps.select-config.outputs.result }}
+          base-ref: ${{ inputs.base-ref }}
+          head-ref: ${{ inputs.head-ref }}