feat: expose research and remediation counts in top_security.json

[PrestaEdit]

Why

Follow-up to #235. After discussion with the security team, the previous choice to keep only research credits in the leaderboard turned out to be wrong on its own terms: the assumption was that remediation credits go to core developers who are already surfaced in the PR/commit leaderboards, so keeping them would double-count. In practice the opposite holds — the developers who patch PrestaShop vulnerabilities push their commits through the private security repository, then have their work republished by the core team, so they never appear as the author on any public PR. The remediation credits on published advisories are therefore the only structured source that surfaces this work, and it's exactly the invisible contribution the security team wants recognised (Clotaire's point on the community thread: research reports are not the current bottleneck, the patching work is — 5× the effort of the initial report).

What this does

Small change on top of #235:

• top_security.json now carries research and remediation counts per contributor, alongside the existing total count.
• The ranking still sorts by total count — one unified leaderboard, no separate boards — so the front end can display research and remediation as breakdown columns.
• Sorting: count descending, then login alphabetically (unchanged).

Output schema

{
  "updatedAt": "2026-07-08",
  "items": [
    {
      "rank": 1,
      "login": "matthieu-rolland",
      "name": "Matthieu Rolland",
      "avatar_url": "...",
      "html_url": "...",
      "count": 4,
      "research": 0,
      "remediation": 4
    },
    ...
  ]
}

Notes

• phpstan and php-cs-fixer pass.
• No change to traces:fetch:security-advisories: gh_security_advisories.json already stored all credit roles as raw data, only the generate step filters.
• Same pipeline dependency as before: the matching TopContributors front-end PR needs a new traces release tag to pick these fields up.

🤖 Generated with Claude Code