Jira-to-GitHub CVE synchronization for keycloak-github-bot

### Summary

Enhance keycloak-github-bot to automatically synchronize CVE titles and descriptions from Jira issue trackers back to the corresponding GitHub issues, ensuring consistent data across both issue trackers and enabling future automation of release notes.

### Problem statement

Today, the CVE workflow creates a disconnect between GitHub and Jira:

1. A CVE request is opened on GitHub and the bot updates the title to `[CVE-TBD] ...`
2. When secalert responds with an assigned CVE, the bot updates the title with the CVE ID (e.g., `[CVE-2025-12345] ...`)
3. However, the final title and description for the CVE are only written when the Jira/Bugzilla issue tracker is created and that information never flows back to GitHub

This means GitHub issues end up with incomplete data, while the final description lives only in Jira.

### Proposed solution

Add bidirectional sync between Jira and GitHub:

1. The bot monitors Jira issues linked to CVEs — when a Jira issue is created or updated for a CVE already tracked on GitHub, the bot detects it
2. Title sync — the bot updates the GitHub issue title to match the finalized Jira title (preserving the `[CVE-XXXX-XXXXX]` prefix)
3. Description sync — the bot updates or appends the CVE description from Jira to the GitHub issue body (or a clearly marked section within it)
4. Sync trigger — this happens on a schedule (polling) considering that we don't have webhooks for it.

The current behavior is acceptable as-is, but we can do better.

### Value & benefits

|Benefit|Who benefits from it|Impact|
|---|---|---|
|Single source of truth|Security team, release engineering|No more manually cross-checking Jira and GitHub for accurate CVE info|
|Automation-ready data|Release engineering, tooling|GitHub becomes a reliable source for programmatically generating release notes|
|Reduced manual toil|Security team|No need to manually update GitHub issues when issue trackers are created on Jira|
|Auditability|Anyone reviewing CVE history|GitHub history shows when and how metadata changed|

### User stories / scenarios

**Scenario: Jira issue finalized after CVE assignment**

> A vulnerability is reported. The security team requests a CVE to secalert; the bot marks it `[CVE-TBD]`. Secalert assigns CVE-2025-54321; the bot updates the title. Secalert creates the Jira issue tracker with the official title "OIDC session fixation via redirect_uri manipulation" and a full description. The bot detects this, updates the GitHub issue title to `[CVE-2025-54321] OIDC session fixation via redirect_uri manipulation`, and appends the description to the issue body.

**Scenario: Release notes**

> At release time, automation queries GitHub for all issues in the CVE bundle. Because titles and descriptions are now synced from Jira, the automation can generate release notes without manual intervention (TBD in a separate issue).

### Diagram

```mermaid
sequenceDiagram
participant GH as GitHub Issue
participant Bot as keycloak-github-bot
participant SA as secalert
participant Jira as Jira Issue Tracker

Note over GH: Issue created
Bot->>GH: Update title to [CVE-TBD]
SA-->>Bot: CVE-2025-XXXXX assigned
Bot->>GH: Update title to [CVE-2025-XXXXX]

Note over Jira: Jira issue created with final title & description
Bot->>Jira: Poll or webhook detects update
Bot->>GH: Sync title and description from Jira
```

### Acceptance criteria

- When a Jira issue linked to a tracked CVE is created or updated, the bot updates the corresponding GitHub issue title
- The GitHub issue title follows the format `[CVE-XXXX-XXXXX] `
- The GitHub issue body contains a clearly marked section with the synced CVE description from Jira
- If the Jira title or description changes, the GitHub issue is updated on the next sync cycle
- The bot logs sync actions
- Existing CVE request flow (TBD → assigned CVE) continues to work unchanged

### Out of scope

- Syncing from GitHub to Jira (this is one-way: Jira → GitHub)
- Syncing any fields beyond title and description
- Modifying how CVE requests are created or how secalert responds
- Automated release note generation itself (this feature just makes the data available)

### Discussion

_No response_

### Motivation

_No response_

### Details

_No response_

No files or tests are named. Start by tracing the existing CVE request flow and the bot's Jira and GitHub integration entry points, then determine how scheduled synchronization fits without changing the current TBD-to-assigned-CVE behavior. Done means Jira title and description changes update the linked GitHub issue, actions are logged, and the existing flow still works.

Written by the indexing model from the issue text.