[connectors] feat: add GitHub connector for web-security

[GangGreenTemperTatum]

tested and working with #26

Summary

Adds a GitHub MCP connector to the web-security capability so validated findings can be exported as GitHub remediation issues.

The connector is deliberately focused on issue creation and follow-up comments. It avoids PR/code automation and adds explicit agent guidance to avoid posting sensitive exploit details to public repositories unless the user confirms intended disclosure.

Changes

• Adds capabilities/web-security/mcp/github.py as a self-contained uv run FastMCP server.
• Wires the github MCP server into capabilities/web-security/capability.yaml.
• Adds agent prompt guidance for GitHub export behavior, required permissions, and public-repo disclosure guardrails.
• Adds focused tests for token handling, label listing, issue creation, issue fetch, and comment creation.

Connector Surface

• github_health
• github_list_labels
• github_create_issue
• github_get_issue
• github_add_comment

Auth uses GITHUB_TOKEN with Issues write permission. GITHUB_API_URL can override the API base for GitHub Enterprise-style deployments.

Validation

• uv run pytest capabilities/web-security/tests/test_github_mcp.py passed: 10 tests.
• mypy capabilities/web-security/mcp/github.py capabilities/web-security/tests/test_github_mcp.py --ignore-missing-imports passed.
• pre-commit run --files capabilities/web-security/capability.yaml capabilities/web-security/agents/web-security.md capabilities/web-security/mcp/github.py capabilities/web-security/tests/test_github_mcp.py passed.
• just validate completed with 0 failures.
• MCP startup smoke passed via uv run capabilities/web-security/mcp/github.py; process stayed running until timeout as expected for stdio MCP.
• PYTHONPATH=capabilities/web-security/tools uv run pytest capabilities/web-security/tests passed: 146 passed, 7 existing warnings.
• git diff --check passed.

Known just validate warnings are pre-existing environment warnings unrelated to this change: bloodhound-enterprise runtime imports, local web-security caido-cli/Burp checks, and windows-reversing Java 17 check.