feat: add react-next-cve skill

[sergical]

Summary

Adds a skill to scan GitHub orgs for repos affected by React/Next.js CVEs.

Usage

Provide a CVE blog post URL and the skill will:

1. Extract affected versions from the blog post
2. Search the org for repos using those packages
3. Check if they're production dependencies
4. Generate a remediation report with correct package manager commands

Example

/react-next-cve https://vercel.com/changelog/summary-of-cve-2026-23864 getsentry

Changes

• Added plugins/sentry-skills/skills/react-next-cve/SKILL.md - Main skill file
• Updated README.md - Added skill to Available Skills table
• Updated plugins/sentry-skills/skills/claude-settings-audit/SKILL.md - Added to skills allowlist
• Updated .claude/settings.json - Added permission for the skill

🤖 Generated with Claude Code

[sentry]

Bug: The verification step incorrectly checks for build and test scripts in the root package.json for monorepos, instead of the specific package's package.json.
_{Severity: HIGH}

Suggested Fix

Modify the verification logic to check for build and test scripts in the correct package.json file. For monorepos, the check should target the package-specific package.json located at the path where dependencies were updated (e.g., {path}/package.json), not the repository root.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: plugins/sentry-skills/skills/react-next-cve/SKILL.md#L180

Potential issue: In a monorepo, the skill's verification step checks for `build` and
`test` scripts in the root `package.json`. However, dependency updates are scoped to
specific packages within subdirectories (e.g., using `pnpm --filter {package-name}`).
The verification logic at lines 178-189 fails to check the package-specific
`package.json` where the changes were made. This causes the build and test verification
steps to be silently skipped if the scripts are defined in the package but not at the
root, potentially missing build errors or test failures for the updated package.