Run npm-update in a GitHub workflow

This avoids a lot of moving parts in our infrastructure (webhook,
npm-trigger roundtrip, tasks container), works in exactly the same way
for independent third-party projects, and does not need *any* secret
other than the automatically provided GitHub token.

Let this run early every morning, roughly similar frequency as
cockpituous used to do. Also add a manual trigger, so that we get a
button to run it on demand.

Closes #384

.github/workflows/npm-update.yml

@@ -0,0 +1,25 @@
+name: npm-update
+on:
+  schedule:
+    - cron: '0 2 * * *'
+  # can be run manually on https://github.com/cockpit-project/starter-kit/actions
+  workflow_dispatch:
+jobs:
+  npm-update:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up dependencies
+        run: sudo apt-get install -y npm make
+
+      - name: Set up configuration and secrets
+        run: |
+          printf '[user]\n\tname = Cockpit Project\n\temail=cockpituous@gmail.com\n' > ~/.gitconfig
+          echo '${{ secrets.GITHUB_TOKEN }}' > ~/.config/github-token
+
+      - name: Clone repository
+        uses: actions/checkout@v2
+
+      - name: Run npm-update bot
+        run: |
+          make bots
+          bots/npm-update