feat: add contract security audit integration

[iammrjude]

Description

Adds contract security audit integration for Soroban contracts, combining StarForge built-in security checks with optional external audit tools like Slither and Mythril. The audit command now supports tool status reporting, security scoring, remediation suggestions, HTML/JSON/text reports, CI failure thresholds, and GitHub Actions workflow generation.

Closes #350

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Changes Made

• Added structured audit tool status reporting for built-in checks, Slither, and Mythril
• Improved external tool integration with cross-platform detection and env var overrides
• Added automated vulnerability scanning pipeline with built-in Soroban heuristics always enabled
• Added security score and CI readiness metadata to audit results
• Added HTML audit report generation alongside existing text/JSON output
• Added --ci, --min-score, --ci-workflow-out, and --track support to starforge security audit
• Added GitHub Actions workflow generation for CI/CD security checks
• Added remediation tracking integration for audit findings
• Updated command reference docs
• Added focused integration tests for audit pipeline, reports, and CI workflow generation

Testing

cargo check
cargo test --test security_audit_integration -- --nocapture
cargo test --test security_hardening -- --nocapture

Test Coverage

• Happy path: built-in audit pipeline runs and records tool statuses
• Reports: text and HTML reports include findings, remediation, and tool status
• CI/CD: generated GitHub Actions workflow invokes starforge security audit
• Compatibility: existing security hardening tests still pass

Breaking Changes

None. Existing security audit behavior remains available, with additional output formats and CI options.

Documentation

Updated docs/COMMAND_REFERENCE.md with the new security audit commands and examples.

[drips-wave]

@iammrjude Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits