feat(ui): Top security researchers ranking

[PrestaEdit]

Why

Security researchers who find and report vulnerabilities never appear on the site today: fixes go through a private security repo and are republished by the core team, so the original reporter is lost from the PR/commit history. This surfaces them from the GitHub security-advisory credits instead.

What this does

• New "🛡️ Top security researchers" card in the Top section.
• New "Security" tab in the Wall of Fame.

Both are fed by top_security.json (produced by the companion traces commands) and reuse the existing ranking table — same Rank / Name / Advisories layout as the reviewers / issues / PR rankings. The card and tab are hidden automatically when the data file is absent, so nothing breaks if the JSON isn't there yet.

The ranking counts research credits only (finder / reporter / analyst) — remediation credits go to core developers already counted in the other leaderboards. See the companion traces PR for the rationale.

Pipeline

.github/workflows/gh-pages.yml gets two new steps (fetch + generate) and publishes top_security.json alongside the other data files.

⚠️ Merge order

This depends on the traces PR: PrestaShop/traces#235. The mv top_security.json step here will fail until a traces release that includes those commands is published. Suggested order:

1. Merge the traces PR
2. Publish a traces release tag
3. Merge this PR

Checks

• ESLint clean.
• vitest green (10/10), including updated coverage for the new card and tab.
• Rendering verified in the dev server: the Security tab lists the credited researchers with their advisory counts.

⚠️ Known limitation (process, not code)

No PrestaShop advisory published since ~May 2024 has its credits filled in, so the ranking currently shows mostly 2020–2024 history and will stay sparse until credits are entered going forward. Credits are retro-editable on published advisories — filling them is a security-team process topic, not a code change here. This feature is meant to be the concrete argument for making that part of the advisory workflow.

🤖 Generated with Claude Code

[Progi1984]

@PrestaEdit PrestaShop/traces#235 is merged

[PrestaEdit]

Thanks @Progi1984 — I also see v6.4.0 was tagged right before your comment, so the composer create-project prestashop/traces step in gh-pages.yml will pick up the new traces:fetch:security-advisories + traces:generate:topsecurity commands on the next schedule/release run.

On this PR side: it's ready for you to merge whenever you want, nothing else pending from me.

Worth restating (it's already in the description): the ranking will stay sparse until the GitHub credits on advisories published since May 2024 get filled in — that's a security-team process topic to raise separately.