Add security-advisory-publish workflow caller

[negillett]

Summary

• Add workflow_dispatch caller for OSV mirror verification after GHSA publish.

Test plan

• Agent precommit checkpoint

Depends on

• intentproof-infra #20

[cursor]

PR Summary

Low Risk
Adds a manually triggered GitHub Actions workflow that delegates to a pinned reusable workflow; low code risk but relies on an external workflow definition/behavior.

Overview
Adds a new manually triggered workflow, security-advisory-publish, that accepts ghsa_id (required) and optional cve_id inputs.

The workflow runs a pinned reusable workflow from IntentProof/intentproof-infra to verify OSV mirroring and inherits repository secrets, with read-only contents and security-events permissions.

^{Reviewed by Cursor Bugbot for commit feae4f1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2a650e0. Configure here.}