Security Info Detect & Parse

[toderash]

Check packages for security contact information. Typical locations include:

• Security: (email or url) plugin header if WP package
• SECURITY.txt or SECURITY.md in package root (any package; case-insensitive)
• If an "official" website URL is given, check the .well-known security URI at domain.com/.well-known/security.txt

VDP

• If a VDP exists, we want to show that in the json output, but it won't be a reliable yes/no at first since we'll only find it by parsing the above locations, if any are found. A future enhancement could check APIs from Patchstack et al, but we won't have a reliable source until the package publisher includes it in their own meta.