Feat skill security

[XiaoSeS]

## Summary

### What changed?

This PR adds **security scanning** and **review content display** features to SkillHub:

**1. Security Scanning Integration**
- Integrated [cisco-ai-defense/skill-scanner](https://github.com/cisco-ai-defense/skill-scanner) for automated security analysis
- Backend: Domain model, Redis Stream async processing, scanner HTTP adapter
- Frontend: Security audit panel in review detail page with findings display
- Deployment: Docker Compose profiles, K8s manifests, runtime.sh support

**2. Review Content Display**
- Reviewers can now view skill README, file tree, and file contents directly in review detail page
- Code syntax highlighting via lowlight (highlight.js)
- Markdown rendering with frontmatter stripping

**3. Access Control Fixes**
- Allow reviewers and namespace admins to view unpublished skill versions
- Fix 400 "版本未发布" errors for PENDING_REVIEW and REJECTED versions

**4. Developer Experience**
- Simplified `make dev-all` to include scanner by default
- Added `--scanner` flag to `runtime.sh` for one-line deployment
- Removed redundant Makefile targets (dev-deps, dev-server-only, dev-all-scanner)

### Why is this needed?

- **Security**: Automated scanning catches malicious code before publication
- **Governance**: Reviewers need to inspect skill content without leaving the review page
- **Usability**: Simplified deployment commands reduce friction for new contributors

## Validation

- [x] Backend tests passed (`make test`)
- [x] Frontend typecheck/build passed (`make typecheck-web`, `make build-web`)
- [x] OpenAPI SDK regenerated (`make generate-api`)
- [ ] Smoke test run when relevant

Commands run:

```bash
# Backend compilation
cd server && ./mvnw compile -DskipTests

# Frontend typecheck
make typecheck-web

# Verify Makefile syntax
make -n dev-all
make -n dev-down

Risk

• User-facing impact:

  • New security audit panel in review detail page (additive, no breaking changes)
  • Scanner disabled by default (SKILLHUB_SECURITY_SCANNER_ENABLED=false), opt-in via env var

• Deployment or migration impact:

  • Database migration V12 adds security_audits table (auto-applied by Flyway)
  • New optional scanner service (profile-gated, won't start unless explicitly enabled)
  • K8s deployments need to apply scanner-deployment.yaml if scanner is desired

• Rollback approach:

  • Scanner can be disabled via SKILLHUB_SECURITY_SCANNER_ENABLED=false (default)
  • Database migration V12 is additive (no data loss on rollback)
  • Frontend changes are backward-compatible (gracefully handles missing audit data)

Notes

• Related issue: N/A (feature development)

• Follow-up work:

  • Add scanner to CI/CD pipeline for automated skill validation
  • Improve markdown rendering quality (deferred per user request)
  • Add scanner metrics to Grafana dashboard

• Docs or operator runbooks updated:

  • README.md updated with scanner deployment options
  • Added docs/security-scanning.md with architecture overview
  • Added scanner/README.md and scanner/QUICKSTART.md
  • Added docs/api/skill-scanner-api.md with API reference