chore(llm): Add skill for fixing security vulnerabilities

[chargome]

Adds /fix-security-vulnerability skill that analyzes Dependabot alerts and proposes fixes.

• Fetches alert details via gh api
• Uses yarn why to trace dependency origin
• Identifies version-specific test packages that shouldn't be bumped (e.g., nextjs-13)
• For transitive deps, recommends bumping the parent package rather than using resolutions
• Presents analysis and waits for approval before making changes
• Runs dedupe-deps:fix and dedupe-deps:check after updates
• Never auto-commits

[JPeer264]

Looks amazing. Theoretically dependabot should already update these (I think we had a bad setup, as our dependabot updates got ignored most of the time).