security-issue-deduplicate gives no guidance when both trackers already have a CVE allocated

## Summary

The ASF `security_committers` policy
(https://www.apache.org/security/committers.html) states:

> `security@apache.org` can help determine if a report requires
> multiple CVE IDs or if multiple reports should be merged under
> a single CVE ID.

The `security-issue-deduplicate` skill handles the case where one
tracker has a CVE and the other does not correctly (keep the one
with the CVE). However when **both** trackers already have a CVE
allocated, the skill's rollup comment template reads:

> CVE: [CVE-N-M] stays allocated here; [#drop] being closed as
> duplicate.

The skill silently picks one CVE to keep and closes the other
tracker — with no instruction to deprecate or reject the dropped
CVE ID via the ASF Security Team. Abandoned RESERVED CVE IDs left
on `cveprocess.apache.org` without being explicitly rejected create
noise in the CNA queue and may confuse downstream consumers.

## What should happen

When both trackers carry a `cve allocated` label, the skill should:

1. **Hard-stop before the merge proposal** and surface an explicit
blocker: "Both trackers have CVE IDs allocated — contact
`security@apache.org` before merging to determine which ID to
keep and which to reject."
2. Only proceed with the merge after the user confirms that
`security@apache.org` has been consulted and one ID has been
designated for rejection.
3. After the merge lands, include a checklist item: "Reject the
dropped CVE ID (`CVE-YYYY-NNNNN`) in Vulnogram and confirm
with `security@apache.org`."

## Required change

In `security-issue-deduplicate`, Step 2 (kept/dropped selection):
add a guard that checks whether *both* trackers carry the
`cve allocated` label or a populated *CVE tool link* body field,
and if so surfaces the blocker above before building the merge
proposal.

## Policy reference

- https://www.apache.org/security/committers.html — "CVE IDs" section

## Notes

The single-CVE case (one tracker has it, the other doesn't) is
already handled correctly and needs no change.