improve(api-security): add cursor tenant-isolation review gates

[brohebot]

Closes #2649

Tightened the api-security skill around cursor-based pagination reviews so it is a little more precise and a little harder to game.

What changed:

• added BOLA checklist coverage for cursor replay across tenant and filter boundaries
• added a benign exception so opaque cursors that are revalidated server-side do not get flagged by default
• added remediation guidance and a regression expectation for cross-tenant cursor replay after auth or membership changes
• called out cursor scope checks in the main SKILL flow and common pitfalls

Validation:

• ruby scripts/validate_skill_schema.rb
• git diff --check

[github-actions]

Thanks for the submission! 🙏 SecuritySkills is now issue-first: contributions need a linked issue that a maintainer has marked approved before a PR is opened.

Please open an issue describing the skill, wait for the approved label, then reopen this PR with Closes #<issue> in the description. The PR template lists everything we'll look for (including an independently runnable reproduction).