[fix][ci] Fix OWASP Dependency Check download by using NVD API key

Signed-off-by: ZhangJian He <[email protected]>

pom.xml

@@ -192,7 +192,7 @@
     <maven-checkstyle-plugin.version>3.3.1</maven-checkstyle-plugin.version>
     <maven-compiler-plugin.version>3.12.1</maven-compiler-plugin.version>
     <maven-surefire-plugin.version>3.2.5</maven-surefire-plugin.version>
-    <dependency-check-maven.version>9.2.0</dependency-check-maven.version>
+    <dependency-check-maven.version>10.0.1</dependency-check-maven.version>
     <nar-maven-plugin.version>3.10.1</nar-maven-plugin.version>
     <os-maven-plugin.version>1.4.1.Final</os-maven-plugin.version>
     <protobuf-maven-plugin.version>0.6.1</protobuf-maven-plugin.version>
@@ -1169,6 +1169,10 @@
             <version>${dependency-check-maven.version}</version>
             <inherited>false</inherited>
             <configuration>
+              <!-- https://issues.apache.org/jira/projects/INFRA/issues/INFRA-26000 -->
+              <nvdApiKeyEnvironmentVariable>NIST_NVD_API_KEY</nvdApiKeyEnvironmentVariable>
+              <!-- Uncomment the following to use the NVD data feed provided by the Dependency-Check project -->
+              <!-- <nvdDatafeedUrl>https://jeremylong.github.io/DependencyCheck/hb_nvd/</nvdDatafeedUrl> -->
               <suppressionFiles>
                 <suppressionFile>src/owasp-dependency-check-suppressions.xml</suppressionFile>
               </suppressionFiles>