Refresh npm lockfiles weekly

[JeroenDeDauw]

Follows-up to #1220

Adds a scheduled workflow that runs npm update against resources/ext.neowiki and tests/RedHerb, verifies the result,
and opens a lockfile-only pull request when anything moved.

Dependabot raises pull requests for dependencies named in a manifest. Nested transitive packages keep whatever version
their parent last resolved, so they drift until an advisory lands on them — as happened with brace-expansion and
js-yaml, whose fixes were already inside the ranges the manifests declare.

The job runs npm ci, the tests, the build and the linters against the refreshed tree before opening the pull request,
so a broken refresh leaves no pull request behind. The pull request itself carries no checks, because GitHub does not
start workflow runs for events raised with GITHUB_TOKEN.

_{AI-authored — Claude Code, Opus 5 (max); asked to automate the dependency refresh after the manual bump in #1220; no revisions; diff not yet human-reviewed; the job's own logic was dry-run against master in a container (npm update, then npm ci, tests, build and linters for both projects, all passing), but the workflow has not yet run on GitHub.}

[JeroenDeDauw]

Superseded by #1223, which gets the same weekly lock file refresh from Renovate's :maintainLockFilesWeekly instead of a bespoke workflow.