feat: implement scheduled update for OWASP secure headers (issue #275)

[alegarciadelrio]

Scheduled updates for OWASP secure headers + source provenance

From #275

Summary

Previously the plugin fetched the OWASP Secure Headers data from a live GitHub raw URL at document-generation time, falling back to a bundled copy only when the request failed. This made doc generation non-deterministic and dependent on a third-party service being reachable.

This PR moves that fetch out of band: the bundled json/owasp.json is now the single source of truth at runtime, and a script + scheduled GitHub Action keep it fresh by opening a PR whenever upstream changes.

Changes

• Runtime is now offline/deterministic — src/owasp.js getLatest() no longer performs an HTTPS request; it populates defaults directly from the bundled json/owasp.json. Removed the https dependency from the module.
• New updater script — scripts/update-owasp-headers.js fetches the latest upstream ci/headers_add.json, validates it parses and has a headers array before overwriting, and re-serializes with stable formatting so CI diffs stay meaningful. Runnable via npm run update:owasp.
• Source provenance — new json/owasp.source.json records the upstream URL, repo, path, branch, resolved commit SHA, and last-update timestamp for the bundled data.
• Scheduled automation — new .github/workflows/update-owasp.yml runs weekly (Mondays 06:00 UTC) and on manual dispatch, fetching the latest data and opening a chore/update-owasp-headers PR for review.
• Tests — test/unit/owasp.spec.js dropped nock HTTP mocking; tests now exercise getLatest() against the bundled data and populateDefaults() directly for new-release scenarios.

Notes for reviewers

• The GitHub Action requires contents: write and pull-requests: write permissions (already declared in the workflow).
• Refreshed the bundled data as part of this commit (last_update_utc bumped to 2026-07-19).