Automate npm audit fix via daily GitHub Action

[Copilot]

Automates vulnerability patching across all package.json files by running npm audit fix daily and opening a PR with changes.

Implementation

• Workflow: .github/workflows/update-npm-audit.yml

  • Scheduled daily at 17:00 UTC (noon ET)
  • Triggers on: schedule, workflow_dispatch
  • Uses Node.js 22.13.0 with npm caching

• Execution order (respects dependency chain):

  1. src/RealtimeServer
  2. src/SIL.XForge.Scripture/ClientApp
  3. scripts/db_tools

• Process per package: npm ci → npm audit fix → commit changes

• PR creation: Uses peter-evans/create-pull-request@v7.0.5 (consistent with update-font-list.yml and update-localizations.yml)

The workflow continues on error to handle packages with no vulnerabilities.

Original prompt

We often need to update NPM dependencies due to vulnterabilities, by running npm audit fix. It would be good to automate this using a GitHub action, and automatically open a PR.

A couple notes:

• We already have some actions that automatically create PRs. Please use the same approach in the action you create.
• There are several package.json files in the repo. They should all have npm audit fix run.
• The packages in ClientApp depend on the packages in RealtimeServer, so make sure to run it in RealtimeServer first, before ClientApp.
• Please make it run daily around noon eastern time.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

---

This change is 

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.52%. Comparing base (6563e48) to head (f42f525).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3645   +/-   ##
=======================================
  Coverage   83.52%   83.52%           
=======================================
  Files         610      610           
  Lines       37512    37512           
  Branches     6172     6148   -24     
=======================================
  Hits        31332    31332           
- Misses       5226     5239   +13     
+ Partials      954      941   -13     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Nateowami]

This PR has Zizmor failures that should be fixed by the merging of #3646.