feat: add security fix command

[solomonneas]

Summary

• add brigade security fix for narrow local security hygiene fixes
• create the local security artifact directory and refresh the managed gitignore block
• document the first safe-fix slice in README, CHANGELOG, and ROADMAP

Verification

• .venv/bin/python -m pytest tests/test_security_cmd.py tests/test_gitignore.py -q
• .venv/bin/python -m pytest -q
• PYTHONPATH=$HOME/repos/content-guard/src python3 -m content_guard scan . --policy $HOME/repos/content-guard/policies/public-repo.json
• live temp repo smoke verified security fix --dry-run, real fix output, and git ignore coverage