Extend CI auto-blob-updates beyond spruce

[nabramovitz]

Current state

The Concourse pipeline has a generic auto-update task (ci/scripts/update-blob) that watches an upstream github-release resource, swaps the blob (bosh remove-blob / add-blob / upload-blobs), appends release notes, and commits the bump to master. It is currently wired up for spruce only (see the spruce job and resource in ci/settings.yml).

Every other tool is bumped manually.

Proposal

Add a resource + job pair in ci/settings.yml for the other tools that publish GitHub release binaries:

• boss (blacksmith-community/boss)
• safe (cloudfoundry-community/safe)
• jq (jqlang/jq)
• openbao (openbao/openbao)
• valkey (valkey-io/valkey)
• natscli (nats-io/natscli)
• cf CLI v8 (cloudfoundry/cli)

Notes / caveats

• update-blob does not update the # <tool> version: comments in packages/toolbelt-*/packaging, so automated bumps leave those comments stale (this already happened with spruce, fixed in Fix stale spruce version comment (v1.35.11) #43). Either teach the script to update the comment or drop the comments.
• Auto-bump commits land directly on master with no testflight gate ahead of them — worth considering whether the blob jobs should feed testflight before pushing.
• From-source tarball tools (mariadb, postgresql, redis, wireshark, nmap, screen) are out of scope here — no github-release asset to watch, and major bumps need manual review anyway.