Extracted the `.rubocop_todo.yml` change from #10397 so thought I'd do
this to all committed (non-vendor) YAML files.

Once every 24h should be sufficient for both of these.

This avoids weirdness like the merged PR commits being pushed to scheduled opened PRs after merging.

It also avoids wasting resources.

- Ensure `spdx.yml` has same fixes as `tapioca.yml`.
- Don't `reset --hard` to ensure that `brew` commands used are those in
  the same branch rather than always from `origin/master`
- Don't check for an existing branch but instead force-push to it if
  there's any updates.
- Provide sample `brew typecheck` command that can be used.

- ensure we reset to `origin/master` so we only have the commit we care
  about in the PR
- ensure we `git add` to include any new files
- don't use `git commit -a` and instead rely only on files added with
  `git add`

Co-authored-by: Seeker <meaningseeking@protonmail.com>

This ensures they have access to the correct secrets.

Increase consistency between workflows, use more of our actions and
`@main`.