fix(commitperclip): stop security gate from hanging the review check

The Run security gates step was hitting the job-level 5-minute timeout
(timeout-minutes: 5) and cancelling the entire 'review' check, even when
the script's documented contract is 'always exit 0 — silent and
informational'.

continue-on-error: true on a step suppresses step failures but does NOT
override a job-level timeout. The script could hang in any unbounded API
call (security-advisories list pagination, the advisory POST/PATCH, etc.)
and take down the whole job.

Four layered defences so any single failure mode is contained:

- ghFetch: per-call AbortController timeout (default 15s) so no single
  GitHub API call can eat the workflow budget.
- check-pr-security: 90s wall-clock watchdog that exits 0 regardless of
  what the rest of the script is doing, matching the always-exit-0
  contract.
- findExistingDraftAdvisory: 20-page pagination cap with console.warn,
  falling through to create a fresh draft instead of looping forever.
- commitperclip-review.yml: timeout-minutes: 3 on the security step
  (combined with continue-on-error: true so the job stays green if it
  ever fires).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/commitperclip-review.yml

@@ -57,6 +57,8 @@ jobs:
 
       - name: Run security gates
         run: node .github/scripts/check-pr-security.mjs
+        continue-on-error: true
+        timeout-minutes: 3
         env:
           GH_TOKEN: ${{ steps.token.outputs.value }}
           GH_REPO: ${{ github.repository }}