Add stale issue/PR bot

[apermo]

Auto-close stale issues and PRs, matching other Surf repos.

• 30 days before stale label
• 14 days before auto-close
• Exempt labels: pinned, security, in-progress