Add spec_update workflow for automated API spec updates

[cguldner]

Summary

• Add a new spec_update.yml GitHub Actions workflow matching the pattern used across other Dropbox SDKs
• Uses OIDC + GitHub App token (sdk-updater-github-app) via AWS Secrets Manager
• Updates the core/src/main/stone submodule to latest, then runs ./gradlew :core:generateStone to regenerate code
• Closes superseded spec update PRs with a comment linking to the replacement
• Adds automated-spec-update label for filtering/tracking
• Triggered via workflow_dispatch or repository_dispatch (type: spec_update)

Notes

• Uses ./update-submodules first to init all submodules (including core/stone), then git submodule update --remote core/src/main/stone to pull the latest spec
• The IAM role oidc-github-dropbox-dropbox-sdk-java-repo needs to be created (the existing oidc-github-dropbox-dropbox-sdk-java-branch-main is scoped to the main branch only)
• The dropbox-sdk-java repo also needs to be added to the dispatch_spec_update.yml matrix in dropbox-api-spec

Test plan

• Verify the IAM role exists (or create it) with access to sdk-updater-github-app
• Trigger via workflow_dispatch and confirm generation succeeds
• Confirm old PRs get closed and commented when a new spec update runs
• Verify the multiline commit message renders correctly in the PR body

🤖 Generated with Claude Code