Add standalone OWASP cheat sheet refresh script

scripts/update-cheatsheets.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DB_PATH="${1:-$ROOT_DIR/standards_cache.sqlite}"
+VENV_DIR="$ROOT_DIR/venv"
+
+if [[ ! -d "$VENV_DIR" ]]; then
+  python3 -m venv "$VENV_DIR"
+fi
+
+source "$VENV_DIR/bin/activate"
+
+# FIX: always install requirements to pick up new/updated packages
+pip install -r "$ROOT_DIR/requirements.txt"
+
+if [[ ! -f "$DB_PATH" ]]; then
+  echo "Database file does not exist: $DB_PATH" >&2
+  exit 1
+fi
+
+# FIX: add PID to backup filename to avoid collisions
+BACKUP_FILE="${DB_PATH}.$(date +%Y%m%d%H%M%S)_$$.bak"
+cp "$DB_PATH" "$BACKUP_FILE"
+if [[ ! -f "$BACKUP_FILE" ]]; then
+  echo "Failed to create backup at $BACKUP_FILE" >&2
+  exit 1
+fi
+echo "Created backup at $BACKUP_FILE"
+
+CRE_NO_CALCULATE_GAP_ANALYSIS=1 \
+CRE_NO_GEN_EMBEDDINGS=1 \
+python "$ROOT_DIR/cre.py" --cheatsheets_in --cache_file "$DB_PATH"
+
+python - "$DB_PATH" <<'PY'
+import os
+import sqlite3
+import sys
+
+db_path = sys.argv[1]
+conn = sqlite3.connect(db_path)
+cur = conn.cursor()
+
+github_prefix = "https://github.com/OWASP/CheatSheetSeries/tree/master/cheatsheets/"
+official_prefix = "https://cheatsheetseries.owasp.org/cheatsheets/"
+
+rows = cur.execute(
+    """
+    select id, link
+    from node
+    where name = 'OWASP Cheat Sheets'
+      and link like ?
+    """,
+    (f"{github_prefix}%",),
+).fetchall()
+
+for node_id, link in rows:
+    filename = os.path.basename(link)
+    html_name = os.path.splitext(filename)[0] + ".html"
+    cur.execute(
+        "update node set link = ? where id = ?",
+        (f"{official_prefix}{html_name}", node_id),
+    )
+
+conn.commit()
+conn.close()
+print(f"Normalized {len(rows)} OWASP Cheat Sheet links")
+PY