feat(scc): migrate to SCC v2 API, add new finding tools, fix sorting and mute

[notluken]

Summary

• Migrate to SCC v2 API — swap securitycenter import for securitycenter_v2, update all parent paths to include /locations/{location}, fix attackExposure score to read from v2 nested message structure
• Add search_findings tool — flexible filtering by class, severity, state, category, resource, mute status, and custom filter string; supports OR-combined values
• Add get_finding_details tool — full finding details including MITRE ATT&CK, compliance, vulnerability data, and optional CAI resource enrichment
• Add search_findings_by_compliance tool — search by CIS, PCI DSS, NIST 800-53, ISO 27001 control IDs/names or free-text across descriptions and categories
• Add set_finding_mute tool — mute or unmute a finding via SetMuteFindingRequest; resolves canonical finding name automatically before calling set_mute
• Fix top_vulnerability_findings sorting — previously sorted only the first page (20 findings); now fetches min(max_findings × 10, 1000) candidates so sort by attack exposure is meaningful across the full population
• Add nextSteps to top_vulnerability_findings — remediation steps now included inline, no follow-up call needed
• Extract _build_parent / _build_or_filter helpers — remove 5× duplicated parent path and OR-filter construction
• Fix more_findings_may_exist in search_findings — use pager next-page token instead of count heuristic
• Add .DS_Store to .gitignore

Test plan

• search_findings returns findings with correct filter applied; OR-combined severity/class works
• get_finding_details returns full finding + CAI resource details
• search_findings_by_compliance matches findings by CIS control ID and free-text description
• set_finding_mute successfully mutes and unmutes a finding; verify in SCC console
• top_vulnerability_findings returns findings sorted by attack exposure score (not just first page order)
• get_finding_remediation still works with finding_id and resource_name + category lookup paths

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.