feat(tools/bugzilla): add tracker bridge for Bugzilla-based projects

Add a new `tools/bugzilla/` tracker bridge so `issue-*` and `security-*` skills can target Bugzilla as the project tracker. Bugzilla has a stable REST API (`/rest/bug`) and XML-RPC.

**Suggested capabilities** (mirror the GitHub bridge surface):

- `search` — by status, product, component, last-changed
- `bug ` — full bug + comments + attachments + flags
- `comment --body-file` — write
- `update --field=val` — status, resolution, severity, assignee, keywords
- `attach ` — write

Same write-path discipline as the other bridges: mutations gated on explicit user confirmation in the calling skill.

**Why:** Bugzilla is the tracker for **Mozilla** (bugzilla.mozilla.org), **Eclipse Foundation**, **GNOME** (historically — still hosts pre-GitLab issues), **KDE** (historically), **LibreOffice**, **Apache OpenOffice** (bz.apache.org!), **Freedesktop** (historically), **Wine**, **Red Hat Bugzilla** (Fedora, RHEL), **GCC**, **GDB**, **glibc**, **Samba**, parts of the **Linux kernel** (bugzilla.kernel.org), **Wikimedia** (legacy). Apache OpenOffice still uses Bugzilla as its primary tracker.

**Reference:**

- Bugzilla REST docs: https://bmo.readthedocs.io/en/latest/api/
- Existing tracker-bridge contract: [`tools/github/tool.md`](../tree/main/tools/github/tool.md), [`tools/jira/README.md`](../tree/main/tools/jira/README.md)
- Issue-body field-schema pattern: [`tools/github/issue-template.md`](../tree/main/tools/github/issue-template.md) — Bugzilla's equivalent is custom fields + the `Whiteboard` / `See Also` / `URL` fields