fix(commitperclip): stop security gate from hanging the review check

The Run security gates step was hitting the job-level 5-minute timeout
(timeout-minutes: 5) and cancelling the entire 'review' check, even when
the script's documented contract is 'always exit 0 — silent and
informational'.

continue-on-error: true on a step suppresses step failures but does NOT
override a job-level timeout. The script could hang in any unbounded API
call (security-advisories list pagination, the advisory POST/PATCH, etc.)
and take down the whole job.

Four layered defences so any single failure mode is contained:

- ghFetch: per-call AbortController timeout (default 15s) so no single
  GitHub API call can eat the workflow budget.
- check-pr-security: 90s wall-clock watchdog that exits 0 regardless of
  what the rest of the script is doing, matching the always-exit-0
  contract.
- findExistingDraftAdvisory: 20-page pagination cap with console.warn,
  falling through to create a fresh draft instead of looping forever.
- commitperclip-review.yml: timeout-minutes: 3 on the security step
  (combined with continue-on-error: true so the job stays green if it
  ever fires).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/scripts/get-bot-token.mjs

@@ -25,19 +25,38 @@ export function generateJWT(privateKey) {
   return `${data}.${sig}`;
 }
 
+// Per-call timeout so a single slow/hung GitHub endpoint cannot eat the entire
+// workflow budget. Overridable via options.timeoutMs for callers that need
+// different bounds.
+export const GH_FETCH_DEFAULT_TIMEOUT_MS = 15_000;
+
 export async function ghFetch(path, token, options = {}) {
-  const res = await fetch(`https://api.github.com${path}`, {
-    ...options,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      Accept: 'application/vnd.github+json',
-      'X-GitHub-Api-Version': '2022-11-28',
-      ...options.headers,
-    },
-  });
-  const text = await res.text();
-  if (!res.ok) throw new Error(`GitHub API ${options.method ?? 'GET'} ${path} → ${res.status}: ${text}`);
-  return JSON.parse(text);
+  const { timeoutMs = GH_FETCH_DEFAULT_TIMEOUT_MS, signal: externalSignal, ...fetchOptions } = options;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new Error(`ghFetch timeout after ${timeoutMs}ms: ${path}`)), timeoutMs);
+  const abortOnExternal = () => controller.abort(externalSignal?.reason);
+  if (externalSignal) {
+    if (externalSignal.aborted) abortOnExternal();
+    else externalSignal.addEventListener('abort', abortOnExternal, { once: true });
+  }
+  try {
+    const res = await fetch(`https://api.github.com${path}`, {
+      ...fetchOptions,
+      signal: controller.signal,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28',
+        ...fetchOptions.headers,
+      },
+    });
+    const text = await res.text();
+    if (!res.ok) throw new Error(`GitHub API ${fetchOptions.method ?? 'GET'} ${path} → ${res.status}: ${text}`);
+    return JSON.parse(text);
+  } finally {
+    clearTimeout(timer);
+    if (externalSignal) externalSignal.removeEventListener('abort', abortOnExternal);
+  }
 }
 
 export async function resolveInstallationId(fetchInstallation, token, repo, owner) {