fix: add allow-list so people can't override to random stuff

Author: erikburt

.github/workflows/dependency-review-vulnerability.yml

@@ -29,7 +29,29 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Choose config preset
+        id: preset
+        env:
+          DEFAULT_PRESET: 'vulnerability-high'
+          OVERRIDE_PRESET: ${{ vars.DEPENDENCY_REVIEW_VULNERABILITY_CONFIG_PRESET }}
+          ALLOWED_PRESETS: 'vulnerability-high vulnerability-high-cve-2026-34040'
+        run: |
+          if [ -z "${OVERRIDE_PRESET:-}" ]; then
+            echo "Using default config preset: $DEFAULT_PRESET"
+            CONFIG_PRESET="$DEFAULT_PRESET"
+          else
+            if echo " $ALLOWED_PRESETS " | grep -q " $OVERRIDE_PRESET "; then
+              echo "Using override config preset: $OVERRIDE_PRESET"
+              CONFIG_PRESET="$OVERRIDE_PRESET"
+            else
+              echo "::warning::Invalid override preset '$OVERRIDE_PRESET'. Falling back to default '$DEFAULT_PRESET'."
+              CONFIG_PRESET="$DEFAULT_PRESET"
+            fi
+          fi
+
+          echo "preset=$CONFIG_PRESET" | tee -a "$GITHUB_OUTPUT"
+
       - name: Dependency Review
         uses: smartcontractkit/.github/actions/dependency-review@dependency-review/v2
         with:
-          config-preset: ${{ vars.DEPENDENCY_REVIEW_VULNERABILITY_CONFIG_PRESET || 'vulnerability-high' }}
+          config-preset: ${{ steps.preset.outputs.preset }}