Add workflow to regenerate required checks

Update contributing guide.
Ensure this workflow runs once a week.

.github/workflows/update-required-checks.yml

@@ -0,0 +1,43 @@
+
+# This job updates the required checks on the codeql-action repository based on the
+# checks performed on the most recent commit.
+
+name: Update required checks
+on:
+  schedule:
+    # 23:01 on Saturdays
+    - cron: "1 23 * * 6"
+  workflow_dispatch:
+
+jobs:
+  update-required-checks:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Dump environment
+      run: env
+
+    - name: Dump GitHub context
+      env:
+        GITHUB_CONTEXT: '${{ toJson(github) }}'
+      run: echo "$GITHUB_CONTEXT"
+
+    - name: Update checks
+      run: |
+        # Update the required checks based on the current branch.
+        # Typically, this will be main.
+        echo "Getting checks for $GITHUB_SHA"
+
+        # Ignore any checks with "https://", CodeQL, LGTM, and Update checks.
+        CHECKS="$(gh api repos/github/codeql-action/commits/${GITHUB_SHA}/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or contains("Update") | not)] | sort')"
+
+        echo "::group::New Checks"
+        echo "$CHECKS" | jq
+        echo "::endgroup::"
+
+        echo "{\"contexts\": ${CHECKS}}" > checks.json
+        echo "Updating main"
+        gh api -X "PATCH" repos/github/codeql-action/branches/main/protection/required_status_checks --input checks.json
+        echo "Updating v2"
+        gh api -X "PATCH" repos/github/codeql-action/branches/releases/v2/protection/required_status_checks --input checks.json
+        echo "Updating v1"
+        gh api -X "PATCH" repos/github/codeql-action/branches/releases/v1/protection/required_status_checks --input checks.json