Weekly workflow to update oxcaml pin

With the merge of https://github.com/ocaml/dune/pull/14248 we would like to maintain the following invariant in the nix flake.

The oxcaml input should match the compiler version in oxcaml-opam-repository.

    oxcaml = {
      url = "github:oxcaml/oxcaml";
    };
    oxcaml-opam-repository = {
      url = "github:oxcaml/opam-repository";
      flake = false;
    };

The ox devShell in the flake is used in the CI job and contains a full dev shell for development with oxcaml and the ability to run the oxcaml tests. The shell works by using nix/opam-overlay.nix which constructs a package set from a given opam repository, in this case oxcaml's.

This means that oxcaml-opam-repository is the source of truth for the oxcaml compiler version. It therefore means we need to keep the oxcaml input in sync.

This does not affect the oxcaml-trunk job which uses the latest source version.

I've already started a workflow in .github/workflows/update-oxcaml.yml but it currently doesn't work due to trivial issues with DCO and CI. We need to have a GitHub personal access token and somebody to take responsibility for the commits. Then the bot would create the PR updating the flake and we will see if it is working in the PR.

Here are some previous runs:

• https://github.com/ocaml/dune/pull/14264

Start with .github/workflows/update-oxcaml.yml and review the existing workflow runs, especially pull request 14264. Check how nix/opam-overlay.nix derives the compiler version from oxcaml-opam-repository and how the workflow handles DCO and CI. Done means the workflow can authenticate, create a commit and pull request updating the flake, and the relevant CI succeeds.