Identify tools to add to project

[mdlmarkham]

Implements 11 new security MCP tools across 4 categories:

Vulnerability Scanning

• scan_container_vulnerabilities: Scan Docker images with Trivy/Grype
• scan_filesystem_vulnerabilities: Scan filesystems for CVEs (LXC containers)

Secrets Detection

• scan_secrets_in_file: Detect exposed credentials in config files
• scan_secrets_in_directory: Recursive secrets scanning
• scan_docker_config_secrets: Check Docker registry credentials

Detects 16+ secret patterns:

• Cloud credentials (AWS, GitHub, Slack, Stripe, Twilio, etc.)
• Private keys (RSA, DSA, EC, OpenSSH)
• Database connection strings
• JWT tokens, Docker auth, NPM tokens

Firewall Management

• get_firewall_status: View firewall state (UFW/iptables)
• list_firewall_rules: List all rules with numbers
• add_firewall_rule: Add allow/deny rules
• delete_firewall_rule: Remove rules by number

Supports UFW (Ubuntu/Debian) and iptables fallback.

CIS Benchmarks

• run_cis_benchmark: Security posture assessment

Profiles: basic (10+ checks), intermediate (15+ checks), comprehensive (20+ checks)

Check categories:

• Filesystem permissions (passwd, shadow, SSH config)
• SSH security (root login, password auth, empty passwords)
• Network hardening (IP forwarding, ICMP redirects)
• System auditing (auditd)
• User account security (UID 0, password complexity)
• Firewall configuration

Returns security score with remediation steps.

Infrastructure

• New scopes: security:read, security:scan, security:write, security:admin
• Risk levels: low (scanning), moderate (filesystem), critical (firewall changes)
• Approval gates for firewall modifications
• Comprehensive tests with unit and integration coverage

Files:

• src/services/security_scanner.py (Trivy/Grype integration)
• src/services/secrets_scanner.py (16+ regex patterns)
• src/services/firewall_manager.py (UFW/iptables)
• src/services/cis_checker.py (Linux hardening checks)
• src/tools/security_tools.py (11 MCP tools)
• src/auth/scopes.py (security scopes)
• tests/test_security_tools.py (test coverage)