Add a section the our CONTRIBUTING.md describing when and how dependencies should be updated, and the criteria for adding a new dependency. Also, add a nightly workflow to run vulncheck. Fixes #635