Add weekly agentic workflow for critical Cargo vulnerability remediation

[Copilot]

What this PR does / why we need it:

Adds a GitHub Agentic Workflow that runs weekly to detect critical Rust dependency vulnerabilities, apply the minimum required Cargo/code updates, verify the repository still builds, and open a remediation PR. This automates security patch flow while preserving existing functionality.

• Workflow definition

  • Introduces .github/workflows/weekly-critical-cargo-vuln-remediation.md
  • Uses schedule: weekly plus workflow_dispatch for on-demand runs
  • Constrains execution to Rust/GitHub network access and read-only job permissions

• Safe PR mutation path

  • Uses safe-outputs.create-pull-request (no direct write permissions in the agent job)
  • Restricts writable scope to Cargo manifests/lockfiles and Rust sources:
    • Cargo.lock, Cargo.toml, **/Cargo.toml, **/*.rs
  • Requires explicit noop when no critical vulnerabilities are found

• Compiled workflow artifacts

  • Adds compiled lockfile workflow:
    • .github/workflows/weekly-critical-cargo-vuln-remediation.lock.yml
  • Adds .gitattributes rule for generated lock workflows:
    • .github/workflows/*.lock.yml linguist-generated=true merge=ours

safe-outputs:
  create-pull-request:
    title-prefix: "[security] "
    labels: [security, dependencies]
    draft: false
    if-no-changes: warn
    allowed-files:
      - "Cargo.lock"
      - "Cargo.toml"
      - "**/Cargo.toml"
      - "**/*.rs"

Special notes for your reviewer:

The workflow is intentionally scoped to critical findings only and to a narrow file allowlist to keep remediations minimal and reviewable.

If applicable:

• this PR has an associated PR with documentation in akri-docs
• this PR contains unit tests
• added code adheres to standard Rust formatting (cargo fmt)
• code builds properly (cargo build)
• code is free of common mistakes (cargo clippy)
• all Akri tests succeed (cargo test)
• inline documentation builds (cargo doc)
• all commits pass the DCO bot check by being signed off -- see the failing DCO check for instructions on how to retroactively sign commits