[Feature] Add agentic SQL injection and XSS checks

[lopez-mar]

WHY are these changes introduced?

App Security has no SQL-injection agentic check. Existing XSS checks focus on DOM writes and specialized Shopify surfaces, leaving gaps in server-rendered app pages, templates, and hydration data.

WHAT is this pull request doing?

Add versioned SQL-injection and cross-site-scripting prompts that trace lower-trust input to executable sinks, verify defenses, and require concrete trust-boundary evidence. Incomplete paths remain unresolved; overlapping XSS findings stay with existing specialized checks.

Register both checks, regenerate the embedded prompts, extend the shipped check-ID contract tests, and add a minor changeset. These are agentic review prompts, not new deterministic detectors.

Local validation passed: engine tests, ESLint, CLI build, and a CLI review-pack/findings round trip. The 34-test check suite also passed after restoring the check-ID assertions. The smoke used hand-authored findings; model detection accuracy has not been evaluated.

How to manually test your changes?

pnpm shopify app security check --path /path/to/app --json --skip-instructions
pnpm shopify app security instructions --path /path/to/app

Checklist

• I have considered possible cross-platform impacts (Mac, Linux, Windows)
• I have considered possible documentation changes
• I have considered analytics changes to measure impact
• The change is user-facing and includes a minor changeset.