feat(skills): Add Django access control and IDOR security review skill

[gricha]

Add a new skill for reviewing Django codebases for access control vulnerabilities, particularly IDOR (Insecure Direct Object Reference) issues.

This skill takes an investigation-based approach rather than pattern matching. Instead of scanning for predefined vulnerable patterns, it guides the agent to:

1. Understand how authorization works in the specific codebase
2. Map the attack surface (resources, endpoints, operations)
3. Ask and answer the core question: "Can User A access User B's data?"
4. Trace specific flows from request to data access
5. Report only confirmed findings with evidence

Includes reference documentation for:

• Django ORM query scoping patterns
• Django view authorization patterns
• DRF permission classes and object permissions
• Multi-tenant isolation approaches

Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access"