✨ feat: factor private vulnerability reporting into Security-Policy check

[bilaldeveloper4312]

This PR checks private vulnerability reporting through GitHub's REST API using go-github's Repositories.IsPrivateReportingEnabled and factors the signal into the Security-Policy check evaluation.

It also:

• returns an explicit unsupported-feature result for non-GitHub clients
• preserves HEAD-only behavior so current repository settings are not applied to historical scans
• adds probe coverage for enabled, disabled, and unsupported states
• updates evaluator tests for the fifth Security-Policy probe
• updates raw-check mocks for the new client call

Fixes #2465

Verification

go test ./clients/githubrepo -run '^TestIsPrivateVulnerabilityReportingEnabled' -count=1
go test ./probes/securityPolicyEnablesPrivateReporting ./checks/evaluation
go test ./checks/raw -run 'Test_Run|TestSecurityPolicy'
go test ./clients/ossfuzz ./clients/azuredevopsrepo ./clients/githubrepo -run '^$'

The focused tests pass locally with Go 1.25.6. The full clients/githubrepo package reaches an unrelated existing Windows tar-path failure in TestExtractTarball; the focused client coverage above passes.

[bilaldeveloper4312]

Correction pushed in e64afd3: private vulnerability reporting status is exposed by GitHub's REST API, not the GraphQL Repository object. I replaced the GraphQL field with go-github's Repositories.IsPrivateReportingEnabled, preserved the HEAD-only guard for historical scans, and added focused enabled/disabled plus non-HEAD tests.

Verification:

• go test ./clients/githubrepo -run '^TestIsPrivateVulnerabilityReportingEnabled' -count=1
• go test ./checks/evaluation -count=1

Both pass locally with Go 1.25.6. The full clients/githubrepo package reaches an unrelated existing Windows tar-path failure in TestExtractTarball; the focused client tests pass.

[github-actions]

This pull request has been marked stale because it has been open for 10 days with no activity