Plugin Directory: Include findings in security scan alerts

[obenland]

Completed security scan callbacks now carry the individual findings. This surfaces them in the review team's Slack alert:

• The top findings, highest risk score first (the callback orders them by id), each with severity, risk score, title, and file:line — capped at five, with the investigation outcome when one reproduced.
• A max-risk-score line, when the callback reports one.
• Untrusted scanner and plugin strings (titles, file paths, severity keys) are escaped for Slack with htmlspecialchars( …, ENT_NOQUOTES ), the idiom of the existing Slack integrations — this neutralizes control sequences like <!channel> in author-controlled file names.

Callbacks without a findings array behave exactly as before. This is display-only groundwork: observing real finding content and scores in the channel informs the threshold for the automatic suspension follow-up (#777, which builds on this).

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

This PR enhances the Plugin Directory’s Gandalf security-scan Slack alerting by including per-finding details from completed scan callbacks, so the review team can see top findings (and max risk score when provided) directly in the alert.

Changes:

• Persist findings (array) and max_risk_score from the callback payload into the Slack notification record.
• Escape untrusted strings for Slack output and add formatted “top findings” lines sorted by highest risk_score.
• Add helper methods to sort findings (top_findings) and generate a one-line excerpt (excerpt).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.