Recognize .mts and .cts TypeScript modules

[shashwat4543]

What changed

Source discovery now treats .mts and .cts files as TypeScript sources, matching Node's
modern ESM/CJS TypeScript module extensions. LANGUAGES[".mts"] and LANGUAGES[".cts"] now
map to "typescript". No rule-level changes were needed: RuleMetadata.languages gates on
the typescript label, not the extension, and every TypeScript-aware rule (AG002, AG004,
AG006, AG007, AG008) already declares "typescript".

Threat model or motivation

Projects increasingly split TypeScript sources into .mts (ESM) and .cts (CJS) files,
especially for dual-published Node packages. Previously these were silently skipped during
discovery — meaning unsafe patterns (shell execution, unsafe fetch, missing tool validation,
prompt injection, etc.) inside those files produced no findings. This closes that discovery
gap with no change to trust boundaries or rule logic.

Validation

• Tests cover vulnerable and safe cases
• make check passes
• Documentation/changelog updated when behavior changed
• Fixtures contain no real credentials or private data

Added tests/test_discovery.py (parametrized over .mts/.cts):

• Positive discovery: an unsafe pattern in .mts/.cts is scanned and detected (AG002)
• Language mapping: LANGUAGES[".mts"]/LANGUAGES[".cts"] equal "typescript"
• Exclusion regression: files under default-excluded paths (e.g. node_modules/) are still skipped
• Size-limit regression: oversized .mts/.cts files still respect max_file_size_kb

Added tests/corpus/true_positives/agent_prompt.mts, a labelled corpus case, so coverage is
measured rather than assumed: an ESM module with web_content interpolated into a
template-literal prompt, expecting AG004. This is deliberately a different rule than the
existing .ts fixture (agent_tools.ts, AG002) — the point is to pin that TypeScript-aware
rules in general stay wired up for the new extensions, not just the one rule already
covered. make bench now shows AG004 at 2 true positives (up from 1) with no new false
positives.

Updated CHANGELOG.md under [Unreleased] and removed the corresponding entry from
docs/GOOD_FIRST_ISSUES.md since it's now implemented.

Related issue

Closes #11