fix(security): align code/secret scanning list JSON with Dependabot

[ningyixi]

Summary

Make list_code_scanning_alerts and list_secret_scanning_alerts return { "alerts": [...], "pageInfo": {...} } so they match list_dependabot_alerts and clients can consume security list tools uniformly.

Why

Fixes #3439

Code Scanning and Secret Scanning list tools returned a bare JSON array while Dependabot already returned an object with alerts and pageInfo. Consumers that expect the Dependabot shape can miss real findings.

What changed

• Wrap code scanning and secret scanning list text payloads in {alerts, pageInfo}.
• Change typed outputs to CodeScanningAlertsOutput / SecretScanningAlertsOutput (same shape as Dependabot).
• Set pageInfo.hasNextPage / hasPreviousPage from REST Link headers via buildOffsetPageInfo for page/per_page pagination.
• Update unit, compatibility, and toolsnap coverage.

MCP impact

• No tool or API changes
• Tool schema or behavior changed
  List text and modern structured output for the two tools become objects instead of bare arrays (breaking for clients that assumed an array root). Output schemas now describe {alerts, pageInfo}.
• New tool added

Prompts tested (tool changes only)

• Mocked: "List code scanning alerts for owner/repo" — text and structured content are {alerts, pageInfo}; Link rel=next sets hasNextPage=true.
• Mocked: "List secret scanning alerts for owner/repo" — same object shape as Dependabot.
• Empty/error compatibility suite for legacy and modern protocols.

Security / limits

• No security or limits impact
  Same alerts and IFC labeling; only response envelope and pagination metadata changed.
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test
  Focused: go test ./pkg/github/ -run 'Security|CodeScanning|SecretScanning|Dependabot|Advisory' (pass). Toolsnaps updated with UPDATE_TOOLSNAPS=true.

Docs

• Not needed
• Updated (README / docs / examples)

AI-assisted: drafted with coding-agent help; changes and tests reviewed by the author.