Add support for creating and updating repository security advisories

首先定位现有的 security_advisories 工具集及其只读工具，然后将它们的模式与链接的三个 GitHub REST API 操作进行比较。工具集支持创建草稿、更新和发布 advisories，以及通过文档化的端点请求 CVE IDs，即表示完成。

Describe the feature or problem you'd like to solve

The current security_advisories toolset only supports reading advisories (list_repository_security_advisories, list_org_repository_security_advisories, get_global_security_advisory). There is no support for creating, updating, publishing, or requesting CVE IDs for advisories via MCP, forcing security teams to context-switch to the GitHub web UI or REST API for these operations.

Proposed solution

Add three new tools to the security_advisories toolset:

• create_repository_security_advisory — create a new draft advisory (POST /repos/{owner}/{repo}/security-advisories)
• update_repository_security_advisory — update an existing advisory, including transitioning state to published (PATCH /repos/{owner}/{repo}/security-advisories/{ghsa_id})
• request_cve_for_repository_security_advisory — request a CVE ID from GitHub for a draft advisory (POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve)

This would allow security teams to manage the full advisory lifecycle — from draft creation through CVE assignment and publication — entirely within the MCP toolset, without leaving their workflow.

Example prompts or workflows (for tools/toolsets only)

1. Create a draft advisory: "Create a draft security advisory for a stored XSS vulnerability in our Core product affecting versions below 2.1.0, patched in 2.1.0."
2. Update an existing draft: "Update advisory GHSA-xxxx-xxxx-xxxx to add the CVSS vector string and change the severity to high."
3. Request a CVE ID: "Request a CVE ID from GitHub for advisory GHSA-xxxx-xxxx-xxxx."
4. Publish an advisory: "Publish advisory GHSA-xxxx-xxxx-xxxx."
5. End-to-end workflow: "Create a draft advisory for an OS command injection vulnerability in our product, request a CVE ID, and publish it once the CVE has been assigned."

Additional context

Relevant REST API documentation:

• [Create a repository security advisory](https://docs.github.com/en/rest/security-advisories/repository-advisories#create-a-repository-security-advisory)
• [Update a repository security advisory](https://docs.github.com/en/rest/security-advisories/repository-advisories#update-a-repository-security-advisory)
• [Request a CVE for a repository security advisory](https://docs.github.com/en/rest/security-advisories/repository-advisories#request-a-cve-for-a-repository-security-advisory)