feat: add security policy suppressions

[solomonneas]

Summary

• add local .brigade/security.toml defaults via brigade security init
• add security policy presets, fail thresholds, template scanning controls, and fingerprint suppressions
• add stable finding fingerprints and use them for security import dedupe
• redact secret-like evidence before reports and imports are written

Verification

• .venv/bin/python -m pytest tests/test_security_cmd.py tests/test_gitignore.py -q
• .venv/bin/python -m pytest -q
• PYTHONPATH=$HOME/repos/content-guard/src python3 -m content_guard scan . --policy $HOME/repos/content-guard/policies/public-repo.json
• git diff --check
• .venv/bin/brigade security init --target "$tmpdir"
• .venv/bin/brigade security scan --target "$tmpdir" --policy public-repo --json
• .venv/bin/brigade security scan --target "$tmpdir" --json
• .venv/bin/brigade security scan --target "$tmpdir" --fail-on none --import-findings
• .venv/bin/brigade work import triage --target "$tmpdir" --limit 5