[fundamental] Add CG in compliance check CI to avoid license issue

[zhengfeiwang]

Description

This PR targets to add CG (Component Governance, link to doc) step in compliance check, so that we can find inappropriate dependency introduced, as #3513 raises, during PR review and avoid change merged without caution.

Note that CG currently does not support detection from pyproject.toml file, so we leverage Python package toml-to-requirements to convert toml files to supported requirements.txt.

All Promptflow Contribution checklist:

• The pull request does not introduce [breaking changes].
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.
• Create an issue and link to the pull request to get dedicated review from promptflow team. Learn more: suggested workflow.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

[github-actions]

promptflow SDK CLI Azure E2E Test Result zhengfei/license-compliance

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 0923bce.

[github-actions]

SDK CLI Global Config Test Result zhengfei/license-compliance

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 0923bce.