pull request automation - ideation

It is clear that we want some pull request automation, both to assist contributors to write a correct
and useful advisory, and to assist the SRT by automating some things. It seems like a webhook "github app"
is the best approach. It will need a token with write access to the repo and we'll need to host it somewhere.
Here are some ideas about what it could do:

- if CVSS and CWE are not set, write a comment pointing to helpful resources
- when CVSS and CWE *are* set, write a comment explaining their values
- recognise commands to update the PR:
- if ***Allow edits and access to secrets by maintainers*** is set for the PR, the app should be able to push (and force-push) to the head branch of the PR, even in forks
- Recognise the `/cwe`, `/cvss`, `/keywords` to update those fields
- When PR is approved by SRT, automatically assign an HSEC-id, and update the head branch (rename file and update TOML `id` field)

No files, tests, or entry points are named. Begin by defining the webhook GitHub App's smallest agreed scope, permissions, hosting, and command behavior; done means the selected PR updates and HSEC-id workflow are implemented and verified.

Written by the indexing model from the issue text.