CircleCI/GHA periodic security audit

[raboof]

We should probably have a nightly/weekly/... build that checks the project for vulnerabilities in dependencies, otherwise they will pop up in a 'random' PR after there haven't been too many changes for a while.

Also, we should consider whether this should use FOSSA or npm audit