A development team ships a microservice that heavily relies on open-source third-party libraries pulled from public package repositories during the build. Security wants the CI/CD pipeline to automatically flag known vulnerabilities (CVEs) and license risks in these external dependencies before the artifact is promoted. Which tool type should be integrated into the pipeline to meet this requirement?