feat: add DeepSec security-scan tracer bullet (COD-450)

[shivros]

Summary

Implements COD-450 tasks 2–7: a fixture-backed examples/security-scan consumer that explicitly projects run_security_scan to CLI, HTTP, and MCP.

• Declares POST /security/scans with required target and optional profile.
• Keeps scanner selection, typed validation, dispatch, and public error mapping consumer-owned; Hydra remains scanner- and vendor-neutral.
• The checked-in fixture accepts only fixture:demo-repo with the baseline profile and never executes caller input.
• Commits generated artifacts and checks both examples for codegen drift in CI.
• Documents the future environment-only DEEPSEC_ENDPOINT/DEEPSEC_TOKEN boundary without adding a real client.

Validation

cargo build --all-targets
cargo test --all-targets
cargo clippy --all-targets -- -D warnings
cargo fmt --all -- --check
cd examples/notes && cargo run -p hydra-codegen --bin hydra-codegen -- check
cd examples/security-scan && cargo run -p hydra-codegen --bin hydra-codegen -- check

All passed. The review panel identified strict request-validation and fixture-bypass issues; those were fixed before this PR was opened. Note: generated CLI omission is represented as JSON null, so profile: null is treated as the documented omitted/baseline profile.

Closes COD-450.

[shivros]

🤖 Automated Review Panel

GPT-5.5 (openai/gpt-5.5)

Initial review found two blocking correctness gaps: the fixture adapter could be bypassed with an invalid typed request, and deserialization admitted undeclared fields. It also requested stronger redaction coverage.

Fixed before opening this PR:

• the fixture now independently rejects any target/profile outside its closed contract;
• ScanRequest fields are private so external callers cannot construct invalid requests;
• request deserialization uses deny_unknown_fields, with a regression proving a sentinel extra field is rejected before adapter invocation;
• generated CLI represents omitted optional profile as JSON null; the consumer treats that as documented baseline omission so the generated CLI remains functional.

No remaining blocking issue identified after the fixes and full gate rerun.

---

Gemini 3 Flash (google/gemini-3-flash-preview)

The review confirmed the explicit three-surface operation, consumer-owned dispatch/adapter boundary, deterministic fixture, generated artifacts, and documentation align with the tracer-bullet contract. It found unknown request fields were silently accepted; this was fixed before PR creation with strict request deserialization and a regression test.

No remaining blocking issue identified after the fixes and full gate rerun.