CONTRIBUTING.md: add a dependency update policy, and nightly vulncheck (#678)

Add a section the our CONTRIBUTING.md describing when and how
dependencies should be updated, and the criteria for adding a new
dependency.

Also, add a nightly workflow to run vulncheck.

Fixes #635

.github/workflows/nightly.yml

@@ -0,0 +1,17 @@
+name: Nightly
+
+on:
+  schedule:
+    - cron: '0 2 * * *'  # 2 AM UTC daily
+
+  workflow_dispatch:
+
+jobs:
+  vulncheck:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Run govulncheck
+      uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
+      with:
+           go-version-file: go.mod
+           go-package: ./...