receive update PRs automatically to fix vulnerabilities in direct dependencies

[freeqaz]

By default, we will create a policy for PR generation that only creates PRs to fix vulnerabilities with a significant impact. Aka, Log4Shell.

This is tied to the CWE, CVSS, and EPSS work we're been doing.

[breadchris]

Depends on #1036