build: will this work on fork pr's?

With .ref, on a PR from a fork, I got:
```
Run actions/dependency-review-action@v3
  with:
    base-ref: master
    head-ref: xml_duplicate_fix
    repo-token: ***
    fail-on-severity: low
    fail-on-scopes: runtime
Error: Bad Request
```

Author: nedbat

.github/workflows/dependency-review.yml

@@ -26,5 +26,5 @@ jobs:
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@v3
         with:
-          base-ref: ${{ github.event.pull_request.base.ref || 'master' }}
-          head-ref: ${{ github.event.pull_request.head.ref || github.ref }}
+          base-ref: ${{ github.event.pull_request.base.sha || 'master' }}
+          head-ref: ${{ github.event.pull_request.head.sha || github.ref }}