fix(stale_repos): resolve false positive 400 errors and fix 1-year duration bug

[Liu-meng-hao]

Note to maintainers: This PR contains TWO distinct fixes:

1. 🐛 Internal CI script bug fix for stale_repositories_test.go (file: stale_repositories_test.go)
2. 📝 README alphabetical order correction in the Security category (file: README.md)

Both changes are logically related to CI reliability improvements. They are kept in one PR for reviewer convenience, but please let me know if you'd prefer them split into separate PRs.

---

Description (1/2): CI Script Bug Fix — stale_repositories_test.go

This PR addresses the false positive dead-link reports mentioned in automated CI runs and fixes several underlying logical bugs in the stale_repositories_test.go script.

Fixes #6279

Root Causes & Key Changes

1. Fatal 1-year commit check bug (time.Duration issue)
Changed numberOfYears to int and explicitly cast during multiplication. Previously time.Duration(1) * 365 * 24 * time.Hour evaluated to ~31.5ms, marking every repository stale.

2. False-positive 400 errors (Anchor links & Query params)
Used standard url.Parse to strip RawQuery and Fragment before validation. Switched to Regex capture groups (FindStringSubmatch) to safely extract owner / repo, preventing malformed API requests like https://api.github.com/repos#actor-model.

3. Rate Limits (403) differentiated from Dead Links (404/410)
Explicitly mapped only 404 and 410 to dead links. For 401/403 (rate limits), the script logs and gracefully aborts the scan via EachWithBreak, preserving already-collected stale repos.

4. CI stability & tech debt cleanup

• Hardcoded http:// → https:// for GitHub API constants
• Added defer resp.Body.Close() to all HTTP requests (prevent TCP connection leaks)
• Added missing noRecentCommits constant to getRepositoriesFromBody for issue dedup closure

---

Description (2/2): README Security Category Alphabetical Fix

Corrects the alphabetical order of two items in the Security section:

• acme-proxy (hyphen, ASCII 45) → should precede → acmetool (letter 't', ASCII 116)
  Per CONTRIBUTING.md alphabetical ordering rules. No new packages added.

---

Required links

⚠️ No new packages added in this PR.
Item 1 is an internal script fix (no package links).
Item 2 is a pure reorder of two existing items (both already had links in their original PRs).
Fields below populated with N/A explicitly so automated regex checkers can find them:

• Forge link: N/A
• pkg.go.dev: N/A
• goreportcard.com: N/A
• Coverage: N/A

---

Pre-submission checklist

• I have read the Contribution Guidelines
• I have read the Quality Standards

---

Repository requirements (N/A: no new packages added)

• The repo has a go.mod file and at least one SemVer release.
• The repo has an open source license.
• The repo documentation has a pkg.go.dev link.
• The repo documentation has a goreportcard link.
• The repo documentation has a coverage service link.

---

Pull Request content

• This PR adds/removes/changes only one package.
• The package has been added in alphabetical order.
• The link text is the exact project name.
• The description is clear, concise, non-promotional, and ends with a period.
• The link in README.md matches the forge link above.

---

Category quality

• The packages around my addition still meet the Quality Standards.
  (No addition — only reordered 2 existing packages in Security, which has 62 items total.)

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[github-actions]

Automated Quality Checks

Required checks

❌ Repo link: missing from PR body

How to fix: Add the following to your PR description:

Forge link: https://github.com/your-org/your-project

❌ **pkg.go.dev**: missing from PR body
  > **How to fix:** Add the following to your PR description:
  > ```
pkg.go.dev: https://pkg.go.dev/github.com/your-org/your-project

❌ Go Report Card: missing from PR body

How to fix: Add the following to your PR description:

goreportcard.com: https://goreportcard.com/report/github.com/your-org/your-project

### Additional checks

⚠️ **Coverage**: missing from PR body
  > **How to fix:** Add a coverage service link to your PR description:
  > ```
Coverage: https://app.codecov.io/gh/your-org/your-project

Popular options: Codecov, Coveralls. Integrate one with your CI to track coverage automatically.

---

Action needed: one or more required checks failed. Please update your PR body with the missing links and ensure the repository meets the quality standards.

These checks are automated and do not replace maintainer review. See CONTRIBUTING.md for full guidelines.

---

PR Diff Validation

Content checks

✅ Description: ends with punctuation
✅ Description tone: no promotional language detected
✅ Category size: Security has 62 items

Warnings

⚠️ Extra files changed: stale_repositories_test.go (expected only README.md for package additions)

How to fix: Package addition PRs should only modify README.md.
If you need other changes, please open a separate PR.
⚠️ Changes: 1 added + 1 removed (update or move — please confirm in PR description)
⚠️ Link text: acmetool differs from repo name acme
How to fix: The link text should be the exact project name.
If the project name really is acmetool, this is fine. Otherwise change it to: - [acme](https://github.com/hlandau/acme) - ...

Automated diff validation — does not replace maintainer review.