Add a knowledge:appsec skill to back reviewer lens B (security)

[prorochestvo]

Context

reviewer lens B is "security & operations," but its only backing skills are
knowledge:production-stability (ops) and knowledge:sql-antipatterns (SQL injection
only). The rest of the security surface the lens is meant to enforce has no catalog to
grade against, so lens B leans on the model's memory instead of a checklist — the exact
gap the other lenses avoid (Go review has stack-go:mistakes, SQL has
sql-antipatterns).

Proposal

Add knowledge:appsec — a compact, review-oriented catalog mirroring
sql-antipatterns' density (per item: smell → why it matters → what to do),
description-matched. Cover the non-SQL security surface:

• authz boundary checks (missing/insufficient authorization, IDOR)
• secret handling (hardcoded secrets, secrets in logs/errors)
• injection classes beyond SQL (command, template, header/CRLF, path traversal)
• SSRF and unsafe outbound requests
• unsafe deserialization
• authentication/session handling
• sensitive-data logging / PII exposure

Wire it into reviewer.md (lens B) and engineer.md (when touching auth or input
boundaries).

Acceptance criteria

• plugins/knowledge/skills/appsec/SKILL.md exists, description-matched.
• Referenced from reviewer.md (lens B) and engineer.md.
• Scope is a checklist catalog (like sql-antipatterns), not a textbook.
• knowledge plugin.json version bumped.