Add support for creating and updating repository security advisories

まず既存の security_advisories ツールセットとその読み取り専用ツールを見つけ、次にそれらのパターンを、リンクされている3つの GitHub REST API 操作と比較します。ツールセットが、ドラフトの作成、advisories の更新と公開、およびドキュメント化されたエンドポイントを通じた CVE IDs のリクエストをサポートすれば完了です。

Describe the feature or problem you'd like to solve

The current security_advisories toolset only supports reading advisories (list_repository_security_advisories, list_org_repository_security_advisories, get_global_security_advisory). There is no support for creating, updating, publishing, or requesting CVE IDs for advisories via MCP, forcing security teams to context-switch to the GitHub web UI or REST API for these operations.

Proposed solution

Add three new tools to the security_advisories toolset:

• create_repository_security_advisory — create a new draft advisory (POST /repos/{owner}/{repo}/security-advisories)
• update_repository_security_advisory — update an existing advisory, including transitioning state to published (PATCH /repos/{owner}/{repo}/security-advisories/{ghsa_id})
• request_cve_for_repository_security_advisory — request a CVE ID from GitHub for a draft advisory (POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve)

This would allow security teams to manage the full advisory lifecycle — from draft creation through CVE assignment and publication — entirely within the MCP toolset, without leaving their workflow.

Example prompts or workflows (for tools/toolsets only)

1. Create a draft advisory: "Create a draft security advisory for a stored XSS vulnerability in our Core product affecting versions below 2.1.0, patched in 2.1.0."
2. Update an existing draft: "Update advisory GHSA-xxxx-xxxx-xxxx to add the CVSS vector string and change the severity to high."
3. Request a CVE ID: "Request a CVE ID from GitHub for advisory GHSA-xxxx-xxxx-xxxx."
4. Publish an advisory: "Publish advisory GHSA-xxxx-xxxx-xxxx."
5. End-to-end workflow: "Create a draft advisory for an OS command injection vulnerability in our product, request a CVE ID, and publish it once the CVE has been assigned."

Additional context

Relevant REST API documentation:

• [Create a repository security advisory](https://docs.github.com/en/rest/security-advisories/repository-advisories#create-a-repository-security-advisory)
• [Update a repository security advisory](https://docs.github.com/en/rest/security-advisories/repository-advisories#update-a-repository-security-advisory)
• [Request a CVE for a repository security advisory](https://docs.github.com/en/rest/security-advisories/repository-advisories#request-a-cve-for-a-repository-security-advisory)