Fix NVD CVE 2.0 API: cveId -> cveIds query parameter

[KarloffsGhost]

NIST's NVD CVE 2.0 API deprecated the cveId query parameter in favor of cveIds (still accepting a single ID). skills/reverse-engineering/scripts/cve_diff.py builds its NVD lookup URL with the old, deprecated parameter name.

This is the exact same one-line fix already verified end-to-end against this repository's own test suite in an isolated, network-disabled container (baseline and post-patch both: 485 passed, 6 skipped).

Full evidence, embedded here so nothing depends on an external link:

• Repository commit verified: 4d62be716fff90fb3249e525e8c771cf621f20c8
• File: skills/reverse-engineering/scripts/cve_diff.py
• SHA-256 before patch: 91299d5f114d98d50b4213574a5067c13939cbd64401986b6d559eaf893a7202
• SHA-256 after patch: f3d040773583b9045509f249b6f5752b2445b590396395d65216668504b60024
• Exact diff:

--- a/skills/reverse-engineering/scripts/cve_diff.py
+++ b/skills/reverse-engineering/scripts/cve_diff.py
@@ -112,7 +112,7 @@
 
 SOURCE_URLS = {
     "osv": "https://api.osv.dev/v1/vulns/{cve}",
-    "nvd": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId={cve}",
+    "nvd": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveIds={cve}",
     "ghsa": "https://api.github.com/advisories?cve_id={cve}",
 }

Opened against my own fork first.