fix(RELEASE-2779): log why embargo check treats a CVE as blocked

[swickersh]

Distinguish embargoed:true from empty/null OSIDB
results and from connection failures so pipeline
logs show the actual fail-closed reason.

Assisted-by: Cursor AI

[codecov-commenter]

Codecov Report

❌ Patch coverage is 97.77778% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 96.83%. Comparing base (7671062) to head (5f2ceec).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
scripts/python/tasks/managed/embargo_check.py	90.90%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #973      +/-   ##
==========================================
- Coverage   96.85%   96.83%   -0.02%     
==========================================
  Files         109      109              
  Lines       10863    10917      +54     
==========================================
+ Hits        10521    10572      +51     
- Misses        342      345       +3     

Flag	Coverage Δ
unit-tests	96.83% <97.77%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ipts/python/tasks/internal/check_embargoed_cves.py	100.00% <100.00%> (ø)
scripts/python/tasks/managed/embargo_check.py	99.43% <90.90%> (-0.57%)	⬇️

... and 2 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7671062...5f2ceec. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[swickersh]

/ok-to-test