Move security data (advisories, alerts, SARIF, dependencies, settings) into RepoState and signing keys into AccountState
signing_key_ids stays in D1 as the fingerprint directory with an owner column; scratch sites get their own scope and host lookups.
16 files changed+344−157
Rendering diff…