Fix Sort Contributors CI failure and exclude Copilot accounts from generated contributor lists

[Copilot]

The Sort Contributors Go Checks workflow was failing because the security target could invoke gosec in a way that breaks when it is installed on-demand. This PR also updates contributor filtering to exclude Copilot-related automation accounts from generated output.

• CI workflow stability (scripts/sort_contibutors/Makefile)

  • Reworked security target control flow to run gosec exactly once:
    • use system gosec if present
    • otherwise install to .tools and execute from that location
  • Removes the failure mode where a second gosec invocation was attempted after the conditional install path.

• Contributor filtering (scripts/sort_contibutors/main.go)

  • Added copilot and copilot-swe-agent to excludedContributors so they are not emitted in generated contributor artifacts.

• Focused regression coverage (scripts/sort_contibutors/main_test.go)

  • Added test coverage for parseContributorList filtering behavior to ensure bot/Copilot-style accounts are excluded while valid contributors remain.

• Repository hygiene (.gitignore)

  • Ignored local script artifacts under:
    • scripts/sort_contibutors/.tools/
    • scripts/sort_contibutors/bin/

security:
	@if command -v gosec >/dev/null 2>&1; then \
		gosec ./...; \
	else \
		GOBIN=$$(pwd)/.tools $(GO) install github.com/securego/gosec/v2/cmd/gosec@latest || exit 1; \
		PATH=$$(pwd)/.tools:$$PATH gosec ./...; \
	fi