build(deps): bump zaproxy/action-baseline from 0.12.0 to 0.15.0

Bumps [zaproxy/action-baseline](https://github.com/zaproxy/action-baseline) from 0.12.0 to 0.15.0.
- [Release notes](https://github.com/zaproxy/action-baseline/releases)
- [Changelog](https://github.com/zaproxy/action-baseline/blob/master/CHANGELOG.md)
- [Commits](zaproxy/action-baseline@66042c8...de8ad96)

---
updated-dependencies:
- dependency-name: zaproxy/action-baseline
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

.github/workflows/security.yml

@@ -294,7 +294,7 @@ jobs:
 
       - name: ZAP baseline scan
         if: steps.guard.outputs.ready == 'true'
-        uses: zaproxy/action-baseline@66042c8e7e24680119199a017e5b0e8603bf4dae  # v0.12.0
+        uses: zaproxy/action-baseline@de8ad967d3548d44ef623df22cf95c3b0baf8b25  # v0.15.0
         with:
           # /health rather than `/`, because that is a URL this application has. What the
           # spider can reach from it is one GET: the rest of the surface is POST-only, and