feat: add dependency-scanning skill for CVE/vulnerability detection

Add a new skill under plugins/advanced-security/skills/dependency-scanning/
that guides agents through scanning project dependencies for known CVEs and
security vulnerabilities using ecosystem-native audit tools.

Supported ecosystems:
- JavaScript: npm audit, yarn audit (v1 and Berry v2+), pnpm audit
- Python: pip-audit
- Rust: cargo audit
- Ruby: bundler-audit
- Go: govulncheck
- .NET: dotnet list package --vulnerable

The skill covers auto-detection of ecosystems via lock files, running the
appropriate audit command with JSON output, presenting findings grouped by
severity (critical -> high -> moderate -> low), and providing per-ecosystem
remediation commands.

Also fixes marketplace.json: spark plugin was referencing ./skills/spark
which does not exist; the correct path is ./skills/spark-app-template.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MabCloud

.github/plugin/marketplace.json

@@ -33,7 +33,8 @@
       "description": "Advanced Security plugin for GitHub Copilot.",
       "version": "1.0.0",
       "skills": [
-        "./skills/secret-scanning"
+        "./skills/secret-scanning",
+        "./skills/dependency-scanning"
       ]
     }
   ]

plugins/advanced-security/README.md

@@ -4,14 +4,19 @@ Security-focused plugin that brings GitHub Advanced Security capabilities into A
 
 ## What it does
 
-Advanced Security helps agents identify and prevent credential exposure during development by:
+Advanced Security helps agents identify and prevent security risks during development by:
 
 - Scanning code snippets, files, and git changes for potential secrets
 - Using GitHub secret detection patterns through MCP tooling
 - Supporting pre-commit checks to catch leaked credentials early
+- Auditing project dependencies for known CVEs and security advisories across multiple ecosystems
 
 ## Skills
 
 ### `secret-scanning`
 
 Activated when a user asks to check code, files, or git changes for exposed credentials. Uses the `run_secret_scanning` MCP tool to scan content for potential secrets before code is committed.
+
+### `dependency-scanning`
+
+Activated when a user asks to audit dependencies, check for known vulnerabilities, or find CVEs in project packages. Automatically detects the package manager in use (npm, Yarn, pnpm, pip, Cargo, bundler, Go modules, or .NET) and runs the appropriate native audit tool to surface vulnerable packages with severity levels and remediation guidance.