feat(skills): add `owasp-ml` skill for OWASP Top 10 ml vulnerability assessment

## Summary

Create the `owasp-ml` skill under `.github/skills/security/owasp-ml/` providing detection checklists, severity guidance, and remediation patterns for the OWASP ML Top 10 2025 vulnerabilities.

This skill is consumed by the `security-reviewer` agent (not user-invocable). Content is adapted from JasonTheDeveloper's owasp-skills `ml-vulnerabilities` skill with hve-core naming and conventions applied.

## Acceptance Criteria

- [ ] `.github/skills/security/owasp-ml/SKILL.md` exists with valid frontmatter
- `name: owasp-ml` matches directory name
- `description` ends with `- Brought to you by microsoft/hve-core`
- `user-invocable: false`
- `metadata.content_based_on` references OWASP ML Top 10 source URL

- [ ] `references/` directory contains 11 files:
- `00-vulnerability-index.md` — summary table with all 10 vulnerabilities
- `01-input-manipulation-attack.md`
- `02-data-poisoning-attack.md`
- `03-model-inversion-attack.md`
- `04-membership-inference-attack.md`
- `05-model-theft.md`
- `06-ai-supply-chain-attacks.md`
- `07-transfer-learning-attack.md`
- `08-model-skewing.md`
- `09-output-integrity-attack.md`
- `10-model-poisoning.md`

- [ ] Each reference file follows the 7-section pattern: Description → Risk → Vulnerability Checklist → Prevention Controls → Example Attacks → Detection Guidance → Remediation
- [ ] `SKILL.md` body references the vulnerability index and instructs the agent on how to traverse references
- [ ] `npm run validate:skills` passes for this skill

## Content Source

Adapted from JasonTheDeveloper's owasp-skills `ml-vulnerabilities/` skill. Naming convention changed from `ml-vulnerabilities` to `owasp-ml` per Discussion https://github.com/microsoft/hve-core/discussions/480 terminology alignment.

## File Structure

```txt
.github/skills/security/owasp-ml/
├── SKILL.md
└── references/
├── 00-vulnerability-index.md
├── 01-input-manipulation-attack.md
├── 02-data-poisoning-attack.md
├── 03-model-inversion-attack.md
├── 04-membership-inference-attack.md
├── 05-model-theft.md
├── 06-ai-supply-chain-attacks.md
├── 07-transfer-learning-attack.md
├── 08-model-skewing.md
├── 09-output-integrity-attack.md
└── 10-model-poisoning.md
```