#7 Security triage of findings

Adds security controls across AutoTriage:

Scan API: Protects /scans endpoints with JWT authentication and the security:scan:submitter role; keeps health checks public.
Repository cloning: Restricts clone URLs to configured hosts and HTTPS/SSH, validates commit IDs and refs, and limits Git protocol use. Archive creation skips symlinks and checks that suppression directories stay inside the clone.
Suppression updates: Verifies the signature on existing suppression files before extending and re-signing them.
Triage dashboard: Renders finding data as text and URL-encodes finding IDs to reduce XSS risk.
Configuration and tests: Adds deployment settings and regression tests for these controls, plus JaCoCo coverage reporting.