chore: enable nightly CVE remediation

.github/workflows/cve-remediation.yml

@@ -0,0 +1,32 @@
+name: Nightly CVE Remediation
+
+on:
+  schedule:
+    # 1:00am Pacific during daylight saving time.
+    - cron: '0 8 * * *'
+  workflow_dispatch:
+    inputs:
+      max_issues:
+        description: Maximum number of unlinked CVEs to process.
+        required: false
+        type: number
+        default: 50
+
+concurrency:
+  group: cve-remediation-${{ github.repository }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+  actions: read
+
+jobs:
+  remediate:
+    uses: sourcebot-dev/sourcebot/.github/workflows/_cve-remediation.yml@main
+    with:
+      workflow_asset_repository: sourcebot-dev/sourcebot
+      workflow_asset_ref: main
+      max_issues: ${{ fromJSON(github.event.inputs.max_issues || '50') }}
+    secrets: inherit