Add GHAzDO to Nucleus FlexConnect integration

[Chad Bentz (felickz)]

Why

Nucleus has a native GitHub Advanced Security connector, but no equivalent GHAzDO connector for Azure DevOps. This adds a repository-hosted path that exports normalized GHAzDO alerts through the documented REST API and ingests them into Nucleus using FlexConnect.

What changed

• Adds a PowerShell exporter for complete active code, dependency, and secret alert snapshots, including continuation-token pagination and safe secret handling.
• Maps CodeQL and normalized third-party SARIF alerts into Nucleus Application assets and vulnerability findings with stable correlation fields.
• Adds a basic C#/.NET Azure Pipelines template that restores dependencies, runs dependency scanning before CodeQL analysis, waits for processing, and uploads the FlexConnect scan.
• Provides optional default-branch filtering, dry-run/artifact output, setup and field-mapping documentation, and fixture-driven validation.

Important limitations

This is file-based point-in-time ingestion, not a bidirectional native connector. Nucleus can resolve findings that disappear from later active snapshots, but FlexConnect cannot preserve GHAzDO dismissal reasons or synchronize accepted-risk and false-positive states. Dependency scanning also has no documented processing-wait input, so the exporter uses bounded snapshot-stability polling after the scan tasks.