ci: scheduled refresh of OpenAPI specs from semgrep.dev

[gaprl]

Stack context

Stacked on #2703 (auto-generated API reference for v1 + v2). That PR makes Mintlify render the API docs from the checked-in specs; this one keeps those specs fresh. Merge #2703 first.

What

New workflow update-openapi-specs.yml (weekday-morning cron + manual workflow_dispatch):

1. Fetches both specs from what semgrep-app serves in production:
   • docs/public_v1.openapi.yaml ← https://semgrep.dev/api/v1/public_v1.openapi.yaml
   • docs/public_v2.openapi.yaml ← https://semgrep.dev/api/v2/openapi.yaml
2. Mirrors x-displayName tag names into x-group (Mintlify's extension for nav group labels; skipped once upstream emits x-group natively).
3. Runs mintlify validate against the fetched specs — a bad or partial upstream spec blocks the update instead of breaking the live docs.
4. Opens a PR only when the specs changed (peter-evans/create-pull-request, chore/update-openapi-specs branch, auto-deleted after merge).

Actions are pinned to full commit SHAs with version comments.

Caveats

• PRs opened with the default GITHUB_TOKEN don't trigger Docs CI on the created PR. Reviewers can close/reopen to run CI, or provide a DOCS_BOT_TOKEN secret (the workflow prefers it automatically when present).
• The live specs currently contain validation bugs (type: bool, duplicate tags, prose in a type: field) that were patched in the checked-in copies in API reference: auto-generate from OpenAPI specs, add v1 and v2 #2703. Until they're fixed at the source in semgrep-app, the first scheduled run will fail at the validate step by design — that's the guard doing its job, not a workflow bug.