Add notify-new-cves action for daily CVE notifications

[peter-at-progress]

Implements automated daily notifications for newly discovered CVEs via Microsoft Teams.

Features:

• Queries scan database for CVEs first observed in the last N days
• Groups by product/channel with severity counts
• Sends formatted Teams message with CVE links and details
• Supports GitHub Actions summary output
• Read-only database access with configurable lookback period

Action inputs:

• database-url: PostgreSQL connection string (read-only)
• data-repo-path: Path to chef-vuln-scan-data for metadata
• teams-webhook-url: Microsoft Teams incoming webhook
• lookback-days: CVE discovery window (default: 1)

See SETUP.md for configuration details and workflow integration examples.

Description

Related Issue

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

• I have read the CONTRIBUTING document.
• I have run the pre-merge tests locally and they pass.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• If Gemfile.lock has changed, I have used --conservative to do it and included the full output in the Description above.
• All new and existing tests passed.
• All commits have been signed-off for the Developer Certificate of Origin.