Auto-assign severity label when a CVE is requested to secalert

### Description

When the team requests a CVE to secalert (via a comment containing the secalert email template), the bot should parse the CVSS score from the comment and automatically assign the corresponding `severity/*` label to the issue. This closes the gap where issues get a CVE requested but the severity label is never applied.

### Value Proposition

The team consistently includes a CVSS score in secalert request emails. Secalert almost always adopts the team's score. Despite this, severity labels are frequently forgotten, leaving triaged issues without proper severity classification. Automating this removes a manual step that is easy to forget and ensures every CVE request results in a correctly labeled issue.

### Goals

- Detect when a comment contains a secalert email template (look for the `* **CVSS:**` field or a CVSS:3.1 vector string)
- Parse the CVSS score and severity from the vector string or the parenthetical (e.g., `4.3 Medium`, `9.1 Critical`)
- Map the severity to the corresponding label:
- Critical (9.0-10.0) → `severity/critical`
- High (7.0-8.9) → `severity/high`
- Medium (4.0-6.9) → `severity/medium`
- Low (0.1-3.9) → `severity/low`
- Apply the label automatically to the issue
- If a `severity/*` label is already present, do not override it (the existing label was set intentionally)
- Automatically apply the label status/embargoed

### Non-Goals

- Validating the CVSS vector or recalculating the score — trust the score as written
- Assigning severity based on non-secalert comments
- Removing or changing existing severity labels

### Discussion

_No response_

### Notes

- The secalert email template always contains a line like: `* **CVSS:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (4.3 Medium)`
- A regex matching `CVSS:3\.1/[A-Z/:]+\s*\((\d+\.\d+)\s+(Critical|High|Medium|Low)\)` should reliably extract both score and severity
- The bot should also handle plain-text variants without bold formatting (e.g., `* CVSS:` without `**`) since the template is sometimes pasted as plain text
- Consider also applying the `kind/cve` label if not already present, since requesting a CVE to secalert implies CVE classification

### Discussion

_No response_

### Motivation

_No response_

### Details

_No response_

No files or tests are named in the issue. Start by locating the comment-handling entry point for secalert requests and existing issue-label application; done means matching the stated CVSS forms, preserving existing severity labels, and applying the requested labels only for secalert comments.

Written by the indexing model from the issue text.