Add security audit tool (MCP + CLI)

[villelaitila]

Summary

• New SecurityService that traverses an sgraph model and collects security data across 6 dimensions: secrets, vulnerabilities, EOL/outdated, risk levels, Backstage metadata, and bus factor
• New sgraph_security_audit MCP tool in the claude-code profile — returns structured JSON for AI agents
• New security_report_cli.py CLI — generates markdown reports for humans
• Non-code files (XML, JSON, YAML, etc.) excluded from bus factor analysis
• 38 unit tests, all passing
• Full documentation with examples in SGRAPH_FOR_CLAUDE_CODE.md

Security dimensions

Dimension	What it finds
secrets	API keys, tokens, national IDs committed to code
vulnerabilities	Known CVEs in dependencies, by severity
outdated	End-of-life frameworks, approaching-EOL packages
risk	Code quality metrics (Softagram Index 0-100)
backstage	Service catalog: owners, lifecycle, public exposure
bus_factor	Single-author critical files, low-author repos

Files

• src/services/security_service.py — core audit logic (single traversal, iterative)
• src/services/__init__.py — updated exports
• src/tools/security_report_cli.py — CLI entry point
• src/profiles/claude_code.py — MCP tool registration
• tests/unit/test_security_service.py — 38 unit tests
• SGRAPH_FOR_CLAUDE_CODE.md, README.md, CLAUDE.md — documentation

Test plan

• Unit tests: 38 tests covering all 6 dimensions, scope filtering, top_n limiting, empty models, non-code file exclusion
• CLI smoke test with real model (arkkikaluste-odoo)
• MCP tool tested live via Claude Code session