[FEATURE]: /security-review — scan diff for secret leaks and hardcoded credentials

Requested feature

Add a /security-review slash command (inspired by Claude Code's /security-review) that scans the working diff for vulnerabilities, hardcoded credentials, and leaked secrets.

Why

openCode has /review for general code review but no signal for secret/credential leakage and security anti-patterns. Searching a diff for tokens/keys is manual today.

Proposed behavior

• /security-review (alias /security) inspects uncommitted changes (or a branch/PR) for:
  • hardcoded API keys, tokens, passwords, .env / .pem / *.key files
  • gitignore/allowlist violations and dangerous patterns (exposed endpoints, unsafe SQL, missing input validation)
• Reuse the review command template infra (packages/opencode/src/command/template/review.txt), scoped to security.
• Emits a prioritized findings list with file:line references.

Benefits

• Catch secret leaks before commit/PR.
• Distinct, focused security pass separate from general /review.