Streamline when vulnerability scans run

[lorenyu]

Vulnerability scans run on many PRs even when the chance that the PR introduced a breaking change is low. It would be better to narrow the paths that trigger vulnerability scans on pull requests, and instead add a scheduled trigger to run vulnerability scans on a regular basis to catch issues that are caused by new vulnerabilities being added to the database rather than code being changed. This will help reduce false positives that block PRs while at the same time increase the ability to monitor and catch new vulnerabilities. See proof of concept here: navapbc/platform-test#169 and additional slack context here 🔒 https://nava.slack.com/archives/C03G1SWD9H7/p1738181871033669