Sync the bundled Codex Security plugin

[ianw-oai]

Update the bundled plugin and SDK plugin version to 0.1.15.

Add the missing scan schemas and workbench scripts. Keep standard and deep CLI scans on their existing scan IDs, leave finalization to the SDK, and restrict multi-path scans to the requested files. Preserve existing fixes for scan recovery, private directories, artifacts, scan ownership, and database migrations.

Validated with three real scans: standard and bounded deep scans found the expected high-severity path traversal, and a scoped scan reviewed only its two requested files. All 784 tests passed, with five expected skips. Package installation, saved history, and JSON, CSV, and SARIF exports also passed.

[mldangelo-oai]

See:

• fix: harden Deep Scan worker startup and finalization #274: Harden Deep Scan worker startup and finalization
• fix: fail stale-target scans closed in CI #273: Fail stale-target scans closed in CI
• fix: make diff-scan writeups and hardening optional #272: Make diff-scan writeups and hardening optional
• fix: repair legacy workbench migration collisions #271: Repair legacy workbench migration collisions
• feat: support model-native Deep Scan workers #270: Support model-native Deep Scan workers
• fix: preserve URLs in security scan context #269: Preserve URLs in security scan context
• fix: keep active scan context current #268: Keep active scan context current
• feat: unify Deep Scan and Standard scan phases #267: Unify Deep Scan and Standard scan phases
• fix: repair incomplete deep-scan schema migrations #266: Repair incomplete deep-scan schema migrations
• feat: measure security scan tokens across workers #265: Measure security scan tokens across workers
• feat: persist scan lifecycle and model metadata #264: Persist scan lifecycle and model metadata
• fix: forward enterprise proxy and certificate settings #263: Forward enterprise proxy and certificate settings
• docs: improve vulnerability writeup quality #262: Improve vulnerability writeup quality

[kmbroai]

One release-blocking portability issue: the synchronized plugin introduces an unprovisioned ripgrep dependency into both Standard and Deep scans.