chore: add agentic workflow for security fixes

[nirinchev]

Adds a github agentic workflow that monitors the security and quality alerts and attempts to resolve them.

[coveralls]

coverage: 78.312%. remained the same — ni/security-aw into main

[Copilot]

Pull request overview

Adds a GitHub Agentic Workflow (gh-aw) to automatically fetch open Dependabot/code-scanning alerts, attempt in-repo remediations, and then create either a draft PR or a triage issue while claiming processed alerts by assigning svc-devtoolsbot.

Changes:

• Add a new agentic workflow source definition (security-quality-agent.md) with an MCP script to select alerts and a safe-output job to assign svc-devtoolsbot on processed alerts.
• Add the compiled gh-aw lock workflow (security-quality-agent.lock.yml) that runs on a daily cron and drives Copilot CLI execution with safe-outputs/threat-detection plumbing.
• Add action pin metadata and mark *.lock.yml workflows as generated with a merge strategy in .gitattributes.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/security-quality-agent.md	Defines the agent instructions, alert-fetching MCP script, and safe-output job for assigning alerts.
.github/workflows/security-quality-agent.lock.yml	Compiled runnable workflow produced by gh-aw from the .md source.
.github/aw/actions-lock.json	Adds pinned action SHAs metadata for (some) actions used by gh-aw.
.gitattributes	Marks *.lock.yml workflows as linguist-generated and sets merge=ours.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lerouxb]

Looks good. I'm willing to try it :)