ci: re-enable List vulnerable packages

[Flash0ver]

Noticed during #4715 (comment) that we previously disabled this workflow.

Do not fail workflow yet, since we still have vulnerable dependencies, that we need to review and update.
A related issue is: #4616

Changes

• enable "List vulnerable packages" workflow again (on pull_request and on daily schedule)
  • but do not fail the workflow run yet
  • after chore: fix vulnerable packages #4757, we still have one vulnerable package left: Update Hangfire.Core to 1.8.20 to fix CVE-2024-21907 #4616
• change to "noun first" form, introduced in .NET 10
• add --no-restore, since we do an explicit dotnet restore in the preceding step

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.84%. Comparing base (356f8e9) to head (0e9e9aa).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4756      +/-   ##
==========================================
- Coverage   73.85%   73.84%   -0.02%     
==========================================
  Files         485      485              
  Lines       17689    17689              
  Branches     3496     3496              
==========================================
- Hits        13064    13062       -2     
- Misses       3765     3766       +1     
- Partials      860      861       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Flash0ver]

@sentry review

[jamescrosswell]

lgtm