[Epic][TypeSpec Authoring][security] Address security issues

Epic to track security-related work for the `azure-typespec-author` skill and related Azure SDK Tools agents / MCP tools.

Scope (will grow over time):

- Address security findings reported by internal scanners (SDL, CodeQL, dependency scanning, secret scanning).
- Review and harden permissions/scopes required by the skill, MCP tools, and agents (principle of least privilege).
- Audit and rotate any credentials / tokens used by the tooling; ensure no secrets are committed or logged.
- Validate prompt-injection / unsafe-tool-call risks in agent flows; add guardrails as needed.
- Keep dependencies up to date; triage CVEs in transitive deps.
- Ensure compliance with org-wide security policies (e.g., content exclusion, allowed networks, signed artifacts).
- Add security-focused tests / lint rules where practical.