feat: --ci flag, 3 new security checks, security-scan workflow

[xlyoung]

Summary

• Add --ci flag to scan command for CI/CD pipelines (JSON output + exit codes)
• Add 3 new security detection engines: unsafe deserialization, dynamic import, log injection
• Create reusable security-scan.yml GitHub Action workflow
• Improve mcp-scan-action.yml with --ci flag and fail_on_high option
• Add 17 new unit tests (78 total, all passing)

New Security Checks (12 engines, up from 9)

1. Unsafe Deserialization — pickle, yaml.load, marshal, shelve, jsonpickle
2. Dynamic Import — import(), importlib.import_module(), require() with user input
3. Log Injection — user input in log statements