ci(owasp): cap job timeout and disable NVD auto-update in check step (#1807)

* ci(owasp): cap job timeout and disable NVD auto-update in check step

The OWASP job intermittently failed with no reason other than timeouts.
Root cause is the unreliable NIST NVD feed (see dependency-check#8633):
keyless NVD downloads are heavily rate-limited and stall.

Two fixes:
- Add timeout-minutes: 30 so a hung NVD download fails fast instead of
  dragging to the 6h GitHub Actions default.
- Add -DautoUpdate=false to the check step so it reads only the cache
  populated by the preceding update-only step. Previously the check step
  carried neither the mirror datafeed URL nor the API key, so on any cache
  staleness/miss it synced directly against NIST - the unreliable path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci(owasp): fall back to NVD mirror when the API update fails

The NIST NVD API is unreliable even with an API key (retries exhausted,
see dependency-check#8633). Previously the mirror datafeed was used only
when no API key was present, so apache/struts always took the flaky API
path and never the mirror.

Make the API update step continue-on-error and run the mirror update as a
fallback when the API step fails (or when no API key is configured).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/owasp.yml

@@ -37,6 +37,7 @@ jobs:
   owasp:
     name: OWASP
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     env:
       HAVE_NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY != '' }}
     steps:
@@ -60,13 +61,15 @@ jobs:
             nvd-cache-${{ runner.os }}-
 
       - name: OWASP Dependency check update cache via NIST_NVD_API_KEY
+        id: nvd-api-update
         if: ${{ env.HAVE_NIST_NVD_API_KEY == 'true' }}
+        continue-on-error: true
         run:  mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-api -Pdependency-update-only --no-transfer-progress
         env:
           NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY}}
 
       - name: OWASP Dependency check update cache via Mirror
-        if: ${{ env.HAVE_NIST_NVD_API_KEY == 'false' }}
+        if: ${{ env.HAVE_NIST_NVD_API_KEY == 'false' || steps.nvd-api-update.outcome == 'failure' }}
         run:  mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-mirror -Pdependency-update-only --no-transfer-progress
 
       - name: Cache NVD Database
@@ -77,7 +80,7 @@ jobs:
           key: nvd-cache-${{ runner.os }}-owasp-${{ github.run_id }}
 
       - name: OWASP check (Without running tests)
-        run: mvn -B org.owasp:dependency-check-maven:aggregate -Pdependency-check -Pjakartaee11 --no-transfer-progress
+        run: mvn -B org.owasp:dependency-check-maven:aggregate -Pdependency-check -Pjakartaee11 -DautoUpdate=false --no-transfer-progress
 
       - name: Upload Dependency Check reports
         uses: actions/upload-artifact@v7