v0.7.0

Added

• Enforced authentication & audit logging: every MCP tool is now scope-gated
  (scan:read / scan:write / config:write / admin) via a new @audited
  wrapper and auth.authorize(); each call emits a structured JSON audit record
  to stderr. Tokens are validated (incl. expiry) for HTTP transports; stdio keeps
  the local trust model.
• Machine-readable output: scan_vulnerabilities, scan_all, and
  scan_git_history accept output_format="json" for agents/CI.
• evaluate_policy tool: runs all scanners and returns an explicit PASS/FAIL
  CI verdict from severity thresholds and an optional "no new vs. baseline" rule.
  save_baseline now accepts scanner_name="scan_all" for aggregate baselines.
• Enterprise finding metadata: Finding now carries cwe, cvss_score,
  cvss_vector, owasp_category, references, and remediation, populated from
  Semgrep, Trivy, OSV-Scanner, Checkov, and Bandit. SARIF export emits a CWE
  taxonomy + taxa and security-severity; dedup merges metadata across scanners.
• Reporting: export_sbom (CycloneDX 1.5 SBOM/VDR) and generate_report
  (standalone HTML executive report) tools and a new reporting/ package.
• New integrations: GitLab MR comments, Slack & Microsoft Teams webhooks,
  and Jira issue creation, plus GitHub PR comments. New tools comment_on_pr,
  notify_slack, notify_teams, create_jira_issue. All credentials are
  environment-only.
• Central config (config.py): one validated Settings object replaces
  scattered os.getenv reads; new SAST_MCP_HTTP_RETRIES, SAST_MCP_HTTP_TIMEOUT,
  SAST_MCP_CACHE_MAX_SCANS knobs.
• Scanner version detection surfaced in list_scanners (get_version()).
• Infra: enforced mypy + coverage floor + self-scan ("dogfood") in CI,
  Dependabot, a CodeQL workflow, a multi-stage Dockerfile.full bundling all CLI
  scanners, and new SECURITY.md / CONTRIBUTING.md / ARCHITECTURE.md.

Changed

• Outbound integrations now share integrations/_http.py with retry, exponential
  backoff, and a configurable timeout.
• The scan cache writes atomically and self-prunes (TTL expiry + size cap).