feat: add checkMalware API for normalized malware detection

[John-David Dalton (jdalton)]

Summary

• Add checkMalware(components) method to SocketSdk with dual-path architecture:
  • Public token → firewall API (firewall-api.socket.dev/purl/{purl}) — returns full artifact data (score, namespace, alert props/categories/fix info) without reshaping
  • Org token → batch PURL API (api.socket.dev/v0/purl) — uses org policy, full artifact data
• Both paths normalize to the same MalwareCheckPackage result shape
• Alerts filtered by policy — only error and warn actions included
• New types: MalwareCheckAlert, MalwareCheckPackage, MalwareCheckResult, MalwareCheckScore
• New constant: SOCKET_FIREWALL_API_URL

Why two paths?

The batch API with public tokens goes through reshapeArtifactForPublicPolicy which strips score, namespace, props, category, and fix from the response. The firewall API returns the same SocketArtifact data but unstripped, giving public token users the same rich data that org token users get.

Normalized result per package

{
  type: string          // ecosystem
  namespace?: string    // e.g. '@types'
  name?: string         // package name
  version?: string
  score?: { overall, license, maintenance, quality, supplyChain, vulnerability }
  alerts: Array<{
    key: string
    type: string        // 'malware', 'criticalCVE', etc.
    severity?: string   // 'critical', 'high', etc.
    category?: string   // 'supplyChainRisk', etc.
    props?: Record      // { note: 'trojan in postinstall' }
    fix?: { type, description }
  }>
}

Test plan

• Public token (firewall): malware with full detail (props, category, fix, score)
• Public token (firewall): warn-level alerts included
• Public token (firewall): clean package — empty alerts, score present
• Public token (firewall): monitor/ignore alerts filtered out
• Public token (firewall): scoped package namespace preserved
• Public token (firewall): multiple packages in parallel
• Public token (firewall): failed requests gracefully skipped
• Org token (batch): server error/warn actions with full alert data
• Org token (batch): missing action defaults to ignore — filtered
• Org token (batch): API error returns success: false
• All 494 tests pass, build and type check clean

[John-David Dalton (jdalton)]

Note: PR #537 (reshapeArtifactForPublicPolicy fix) touches overlapping code. Whichever lands first will require a rebase of the other.