Try a workaround for the OWASP compliance tool in JS, which is broken…

… upstream

tracdap-api/packages/web/package.json

@@ -28,7 +28,7 @@
   "devDependencies": {
     "protobufjs-cli": "~1.1.2",
     "license-checker-rseidelsohn": "~4.1.1",
-    "owasp-dependency-check": "0.0.21",
+    "owasp-dependency-check": "etnetera/owasp-dependency-check",
     "node-fetch": "^3.3.2"
   },
   "overrides": {
@@ -40,7 +40,7 @@
     "tracVersion:windows": "for /f %v in ('powershell -ExecutionPolicy Bypass -File ..\\..\\..\\dev\\version.ps1') do npm version \"%v\"",
     "tracVersion:posix": "npm version `../../../dev/version.sh`",
     "buildApi": "node api_builder.js",
-    "compliance-owasp": "owasp-dependency-check --project \"tracdap-web-api\" --suppression ../../../dev/compliance/owasp-false-positives.xml --failOnCVSS 4 --data ../../../build/compliance-cache/nvd_web_api --out ../../../build/compliance/web-api-owasp/",
+    "compliance-owasp": "owasp-dependency-check --odc-version v9.0.9 --project \"tracdap-web-api\" --suppression ../../../dev/compliance/owasp-false-positives.xml --failOnCVSS 4 --data ../../../build/compliance-cache/nvd_web_api --out ../../../build/compliance/web-api-owasp/",
     "compliance-licenses": "license-checker-rseidelsohn --onlyAllow \"MIT; Apache-2.0; BSD; BSD-3-Clause; ISC; BSD-2-Clause; Unlicense; WTFPL; Python-2.0\" --excludePackages \"spdx-exceptions;spdx-license-ids\" --json --out ../../../build/compliance/web-api-licenses/license-report.json",
     "compliance-audit": "npm audit --omit dev > ../../../build/compliance/web-api-npm-audit/npm-audit.txt",
     "pbtsTask": "pbts -o tracdap.d.ts tracdap.js"