[fix][ci] Owasp check: do not use 'install verify' to avoid build fai…

…lures (apache#15119)

.github/workflows/ci-owasp-dep-check.yaml

@@ -57,6 +57,7 @@ jobs:
               - '**/pom.xml'
               - 'src/owasp-dependency-check-false-positives.xml'
               - 'src/owasp-dependency-check-suppressions.xml'
+              - '.github/workflows/ci-owasp-dep-check.yaml'
 
       - name: Cache local Maven repository
         if: ${{ steps.changes.outputs.poms == 'true' }}
@@ -87,9 +88,9 @@ jobs:
           df -h
 
       # Projects dependent on flume, hdfs, hbase, and presto currently excluded from the scan.
-      - name: run "clean install verify" to trigger dependency check
+      - name: run "clean verify" to trigger dependency check
         if: ${{ steps.changes.outputs.poms == 'true' }}
-        run: mvn -q -B -ntp clean install verify -PskipDocker,owasp-dependency-check -DskipTests -pl '!pulsar-sql,!distribution/io,!distribution/offloaders,!tiered-storage/file-system,!pulsar-io/flume,!pulsar-io/hbase,!pulsar-io/hdfs2,!pulsar-io/hdfs3,!pulsar-io/docs'
+        run: mvn -q -B -ntp clean verify -PskipDocker,owasp-dependency-check -DskipTests -pl '!pulsar-sql,!distribution/io,!distribution/offloaders,!tiered-storage/file-system,!pulsar-io/flume,!pulsar-io/hbase,!pulsar-io/hdfs2,!pulsar-io/hdfs3,!pulsar-io/docs'
 
       - name: Upload report
         uses: actions/upload-artifact@v2