[fix][ci] Fix OWASP Dependency Check download by using NVD API key

[hezhangjian]

See more in apache/pulsar#22999. Thanks for @lhotari
INFRA-TICKET https://issues.apache.org/jira/projects/INFRA/issues/INFRA-26000

[hezhangjian]

@lhotari It seems download is still failed, do we need to merge this first?

[lhotari]

@lhotari It seems download is still failed, do we need to merge this first?

Yes. Another option would be to create the PR branch to apache/bookkeeper so that it has access to the secret. The dependency check version must be at least 10.0.2 (there's another Pulsar PR explaining that).

[hezhangjian]

@lhotari Thanks, I see your description in apache/pulsar#23012.

I suggest we can merge this pr first.

There's a mandatory upgrade notice about upgrading to 10.0.2 version.

[lhotari]

I suggest we can merge this pr first.

That works for me, but why not just upgrade to 10.0.2 in this PR?

[lhotari]

Looks like 10.0.2 is used in this PR, LGTM.

[lhotari]

There's a error building the docker image

[INFO] Package netcat is a virtual package provided by:
[INFO]   netcat-traditional 1.10-48
[INFO]   netcat-openbsd 1.226-1ubuntu2
[INFO] 
[INFO] E: Package 'netcat' has no installation candidate

I believe netcat-openbsd should be used.