[REVIEW] iac-security: add policy-as-code expiry, secret zero-values, and module source digest gates

[JamesJi79]

Adds three review gates for iac-security skill:

1. Policy-as-Code Exception Expiry Gate (closes [REVIEW] iac-security: add policy-as-code exception expiry gates #2677)

   • Exception lifecycle governance check
   • Exception scope narrowing check

2. Secret Zero-Values in Plan Diffs Gate (closes [REVIEW] iac-security: add secret zero-values in plan diffs gates #2676)

   • Sensitive value source verification check
   • Provider default drift detection check

3. Module Source Digest and Mirror Pinning Gate (closes [REVIEW] iac-security: add module source digest and mirror pinning gates #2675)

   • Module source integrity check
   • Private registry mirror integrity check

All three gates add evidence requirements for common IaC false-positive patterns.

[github-actions]

Thanks for the submission! 🙏 SecuritySkills is now issue-first: contributions need a linked issue that a maintainer has marked approved before a PR is opened.

Please open an issue describing the skill, wait for the approved label, then reopen this PR with Closes #<issue> in the description. The PR template lists everything we'll look for (including an independently runnable reproduction).