docs: update scripts/security/README.md for PSGallery staleness check

**Component:** Documentation

## Bug Description

`scripts/security/README.md` does not describe the PowerShell Gallery module staleness checking capability added to `Test-SHAStaleness.ps1` and `SecurityHelpers.psm1` in commit [50c1767](https://github.com/microsoft/hve-core/commit/50c1767bd38d53e9ee2d0b1929c1427d9a2c18b8) (PR #1379).

Two sections are now stale:

**`Test-SHAStaleness.ps1` — Features list** omits:
- Checking `psModules` entries in `tool-checksums.json` against the PSGallery OData v2 API via the new `Get-PSModuleStaleness` function
- Reporting stale PowerShell modules alongside GitHub Actions in the output
- The per-module `sha256ByArch` field on module results

**`SecurityHelpers.psm1` — function table** is missing:
- `Get-PSGalleryApiBase` — returns the PSGallery OData base URL (respects `HVE_PSGALLERY_REPOSITORY` env var for mirrors/test doubles)

## Expected Behavior

The `Test-SHAStaleness.ps1` Features bullet list should include a line such as:

> * Checks pinned PowerShell modules in `tool-checksums.json` (`psModules` array) against the PowerShell Gallery OData v2 API

The `SecurityHelpers.psm1` function table should include a row for `Get-PSGalleryApiBase` alongside the existing `Write-SecurityLog` row.

## Steps to Reproduce

Review commit [50c1767](https://github.com/microsoft/hve-core/commit/50c1767bd38d53e9ee2d0b1929c1427d9a2c18b8) (PR #1379), which added `Get-PSModuleStaleness` to `Test-SHAStaleness.ps1` (164 additions) and `Get-PSGalleryApiBase` to `SecurityHelpers.psm1`, without updating `scripts/security/README.md`.

## Additional Context

- Stale documentation: [`scripts/security/README.md`](https://github.com/microsoft/hve-core/blob/main/scripts/security/README.md) — `Test-SHAStaleness.ps1` section and `SecurityHelpers.psm1` module table
- Updated code: [`scripts/security/Test-SHAStaleness.ps1`](https://github.com/microsoft/hve-core/blob/main/scripts/security/Test-SHAStaleness.ps1) (function `Get-PSModuleStaleness`, line 725)
- Updated code: [`scripts/security/Modules/SecurityHelpers.psm1`](https://github.com/microsoft/hve-core/blob/main/scripts/security/Modules/SecurityHelpers.psm1) (function `Get-PSGalleryApiBase`, line 344)
- Config file extended: [`scripts/security/tool-checksums.json`](https://github.com/microsoft/hve-core/blob/main/scripts/security/tool-checksums.json) now includes a `psModules` array

> [!NOTE]
>
> 🔒 Integrity filter blocked 4 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#435](https://github.com/microsoft/hve-core/issues/435) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#424](https://github.com/microsoft/hve-core/issues/424) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#389](https://github.com/microsoft/hve-core/issues/389) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1326](https://github.com/microsoft/hve-core/issues/1326) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

> Generated by [Documentation Update Check](https://github.com/microsoft/hve-core/actions/runs/24856752979/agentic_workflow) · ● 2.1M · [◷](https://github.com/search?q=repo%3Amicrosoft%2Fhve-core+is%3Aissue+%22gh-aw-workflow-call-id%3A+microsoft%2Fhve-core%2Fdoc-update-check%22&type=issues)

Start with scripts/security/README.md and compare its Test-SHAStaleness.ps1 feature list and SecurityHelpers.psm1 function table with Get-PSModuleStaleness in scripts/security/Test-SHAStaleness.ps1 and Get-PSGalleryApiBase in scripts/security/Modules/SecurityHelpers.psm1. Check scripts/security/tool-checksums.json for the psModules configuration. Done means the README documents PSGallery staleness checks, module result details, and the missing function.

Written by the indexing model from the issue text.