Fix Scorecard supply-chain alerts: add fuzzing tests and CODEOWNERS

[Copilot]

Five OpenSSF Scorecard alerts were flagged in this repo. Three are false positives (process/time-based), two are addressable via code and config changes.

Changes

Alert #17 – Fuzzing (Medium) — Fixed

• Added src/test/property.test.ts using fast-check for property-based testing, which Scorecard recognizes as a fuzzing integration for TypeScript/JavaScript projects
• Tests cover invariants on all error classes (AlienSecError, AlienVaultAPIError, VirusTotalAPIError, DatabaseError, ConfigurationError) and EndpointFlavor validation logic

// Example: VirusTotalAPIError flag invariants
fc.assert(
  fc.property(fc.string(), fc.integer({ min: 100, max: 599 }), fc.boolean(), fc.boolean(),
    (message, statusCode, isRateLimit, isQuotaExceeded) => {
      const err = new VirusTotalAPIError(message, statusCode, isRateLimit, isQuotaExceeded);
      expect(err.isRateLimit).toBe(isRateLimit);
      expect(err.isRetryable).toBe(isRateLimit);
    })
);

Alert #1 – Branch-Protection (High) — Partially Fixed

• Added .github/CODEOWNERS assigning @VrilLabs as required reviewer on all paths
• Remaining settings (required reviewers count, status checks, force-push prevention) must be enabled in GitHub → Settings → Branches by a repo admin

---

False Positives (no code change possible)

Alert	Reason
#18 Code-Review	0/24 historical commits reviewed — cannot retroactively add PR approvals
#19 Maintained	Repo is < 90 days old; score improves automatically over time
#20 CII-Best-Practices	Requires maintainer to register at bestpractices.dev

[Copilot]

Pull request overview

This PR addresses OpenSSF Scorecard supply-chain alerts by adding a recognized fuzzing/property-based testing integration (fast-check) and introducing CODEOWNERS configuration to support branch-protection expectations.

Changes:

• Added property-based tests with fast-check for core error classes and EndpointFlavor-related invariants.
• Added fast-check as a dev dependency (with corresponding lockfile updates).
• Added .github/CODEOWNERS to designate repository reviewers/owners for all paths.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/test/property.test.ts	Introduces fast-check property-based tests to satisfy Scorecard fuzzing signal and validate error-class invariants.
package.json	Adds fast-check to devDependencies.
package-lock.json	Locks fast-check (and transitive pure-rand) and records updated npm metadata.
.github/CODEOWNERS	Defines code ownership for all paths to support branch protection / code-owner review flows.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.