Wire existing NVD secret into a pinned OWASP CI scanner

[philipgreat]

CI run 34040684967 fails in OWASP Dependency Check: no NVD API key was supplied; generated examples resolve scanner 13.0.0 while the runtime POM pins 10.0.4. The repository already has NVD_API_KEY, but ci.yml does not reference it. Connect it using nvdApiKeyEnvironmentVariable (not plaintext command interpolation), pin one scanner version across reactor modules, retain the security gate, and verify CI. No secret value is needed in logs or local files.