[PM-13621] Add cron job to regularly update SPM dependencies in project files

[KatherineInCode]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-13621

📔 Objective

This creates a new cron job in the pattern of our "update public suffix list" job that checks the SPM packages defined in our project files for updates, and if they exist creates a PR for it. The update-dependencies.sh script can also be run offline if desired.

This should hopefully let us keep better tabs on those updates, and keep our dependencies up to date.

This has also been an opportunity for me to experiment with Claude Code, in terms of writing the bash script.

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – a7bb110c-5a57-4d21-966e-eac33062d088

Great job, no security vulnerabilities found in this Pull Request

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.05%. Comparing base (a55e307) to head (b187bbd).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1753       +/-   ##
===========================================
- Coverage   88.81%   70.05%   -18.76%     
===========================================
  Files         810      260      -550     
  Lines       51561    11789    -39772     
===========================================
- Hits        45794     8259    -37535     
+ Misses       5767     3530     -2237     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[vvolkgang]

Consolidating what we discussed and some review notes:

• xcodegen project files will be the source of truth and we should untrack Package.resolved, we'll use xcodegen project files for caching purposes
• We need to pin dependencies to revision: - for human review purposes confirm if we can continue having the exactVersion: setting in project-*.yml files, otherwise we can add a comment next to the revision hash with the release tag name, example.
• Replace GitHub API curl calls with GH CLI - for examples search for GH_TOKEN in our repo.
• Consider using python (with classes) instead of bash for the script, they've been easier to maintain and improve. I can help you set it up with uv.
• Listing updated packages in the PR description - I can help with that, we can try mimicking some of the Renovate PRs structure. 🤔