How to secure your software supply chain from dependencies to deployment