Auto-discover and verify new gov dependencie

[haseebmalik18]

Summary

Adds the tooling to keep src/gov-dependencies.data.ts updated on its own instead of by hand. Depends on #126, merge that first since this builds on its data and logic split.

Changes

• Crawls an allowlist of federal GitHub and npm orgs and reads their repos' manifests and READMEs to find packages.
• Verifies each candidate two ways before trusting it: the package's registry metadata has to point at a repo in an allowlisted org, and that repo has to declare the package name in its package.json, pyproject.toml, or README
  install command.
• Pulls npm org listings as a second source. Packages under an agency's npm org are proven by npm's access controls, so they skip verification.
• Caches repos by last push time, so after the first run it only rechecks repos that actually changed.
• Only ever adds entries, never removes. Anything it can't verify is flagged for a maintainer to check instead of being added silently.
• Allowlist is 186 federal orgs, checked against CISA's official .gov registry and GSA's federal org list.

Notes

• The weekly workflow and CODEOWNERS reviewer auto-assignment come in a follow up PR
• Discovery is kept modular so the code-gov inventory can slot in as the data source in Phase 3.

Part of issue: #124

[decause-gov]

There's a risk we'll hit API limits, but other than that, in the interest of completing this rotation before EoW, we're gonna merge and see what happens... that's what git is for ;)

[natalialuzuriaga]

Love the latest update with the new comment additions and documentation update, it makes this aspect of the tool a lot more easier to navigate and understand. After this last thing is address, should be good to merge!

[natalialuzuriaga]

In this section could you specifically list the commands to run the job so it is straightforward for future devs? Also just wanted to verify if the job is automated? I don't see a workflow file / code of when the job is triggered to run and makes the PR with the data list update but I could've missed something.

[haseebmalik18]

Just added, I wanted to keep it a seperate PR for adding the automated workflow to avoid crowding this PR, but in the interest of time it is probably best to just add it here.

[natalialuzuriaga]

Love the latest update with the new comment additions and documentation update, it makes this aspect of the tool a lot more easier to navigate and understand. After this last thing is address, should be good to merge!