fix(security): address npm CVEs in rundeck-cli; schedule weekly Snyk

- Pin xml2js via overrides (CVE-2023-0842)
- Bump js-yaml to 3.14.2; override follow-redirects to 1.16.0
- Run Snyk workflow weekly on Mondays (UTC)

Author: fdevans

.github/workflows/snyk-scan.yml

@@ -5,6 +5,9 @@ on:
     branches: [ main, master ]
   pull_request:
     branches: [ main, master ]
+  schedule:
+    # Weekly on Monday 06:00 UTC (GitHub Actions cron is UTC-only)
+    - cron: '0 6 * * 1'
   workflow_dispatch:
 
 jobs:

docker/client/rundeck-cli/package-lock.json

@@ -13,7 +13,7 @@
     "@types/node": "^13.13.5",
     "dotenv": "^10.0.0",
     "form-data": "^3.0.0",
-    "js-yaml": "^3.13.2",
+    "js-yaml": "^3.14.2",
     "node-fetch": "^2.6.1",
     "ts-node": "^8.10.1",
     "ts-rundeck": "^0.1.8",
@@ -28,8 +28,10 @@
   },
   "overrides": {
     "axios": "1.15.0",
+    "follow-redirects": "1.16.0",
     "tough-cookie": "4.1.3",
     "xml-js": "0.5.1",
+    "xml2js": "0.6.2",
     "diff": "4.0.4"
   }
 }