feat: security advisory aggregator, manifest API rewrite, namespace rename (#150, #283)

- Add `security:advisories` command — cross-repo CVE scanner via composer audit
  with checkpoint resumability, severity filtering, and auto-issue creation
- Rewrite `manifest:read` to use Gitea manifest API as primary source with
  auto-detection fallback from source tree (no more manifest.xml dependency)
- Rename MokoStandards namespace → MokoCli across all files
- Rename MokoEnterprise namespace → MokoCli across all files
- Rename MokoStandardsParser class → ManifestParser
- Fix composer.json autoload paths: src/ → source/

lib/Enterprise/InputValidator.php

@@ -37,7 +37,7 @@ declare(strict_types=1);
  * @license GPL-3.0-or-later
  */
 
-namespace MokoEnterprise;
+namespace MokoCli;
 
 use InvalidArgumentException;
 use RuntimeException;
@@ -65,7 +65,7 @@ class ValidationError extends RuntimeException
  *
  * Example:
  * ```php
- * use MokoEnterprise\InputValidator;
+ * use MokoCli\InputValidator;
  *
  * $path = InputValidator::validatePath('/tmp/file.txt');
  * $email = InputValidator::validateEmail('user@example.com');