feat(ui): split security ranking into research + fix credits

[PrestaEdit]

Why

Follow-up to #237. After discussion with the security team, the split between the two kinds of credited work is worth showing everywhere, not only in the Wall of Fame — because that's the whole point of the board:

• The people who find and report vulnerabilities show up on public GitHub anyway (advisory pages, sometimes their own writeups); it's decent recognition.
• The people who ship the fix push their commits through the private security repository, then their patches are republished by the core team on the public repo — so they never appear as author on any public PR or commit. Their work is invisible everywhere else in the Top Contributors site. This board is essentially the only place it surfaces.

Hiding that behind a single total defeats the purpose. Both views now show the breakdown.

What this does

Both the compact Top card in the Top section and the Wall of Fame Security tab now display three numeric columns:

Advisories · Research · Fixes

• Advisories — total credited advisories (sort key, unchanged).
• Research — advisories where the person holds a finder / reporter / analyst / coordinator credit.
• Fixes — advisories where the person holds a remediation_developer / reviewer / verifier credit.

Fed by the new research and remediation fields on top_security.json. TopRankingView gets an optional extraColumns prop so the other cards (Reviewers / Issues / PR authors) stay single-column and untouched.

Card title stays neutral ("🛡️ Top security contributors") — the split does the talking.

⚠️ Merge order

Depends on the traces PR: PrestaShop/traces#236. The top_security.json published by the current traces release (v6.4.0) only carries count; the front columns will render - until a new traces release is published including #236. Suggested order:

1. Merge feat: expose research and remediation counts in top_security.json traces#236
2. Publish a traces release tag
3. Merge this PR

Checks

• ESLint clean.
• vitest green (12/12), including new coverage for the extra-columns rendering.
• Verified in the dev server: card and tab both show Advisories / Research / Fixes with correct per-family counts.

🤖 Generated with Claude Code

[PrestaEdit]