[John-David Dalton (jdalton)]

Port the scan report policy-grading fix from PR #1494 to v1.x. Grade each alert from its resolved action in the full-scan response, removing the stale policy fetch and the extra permission/quota requirement.

Source change: SocketDev/socket-cli#1494.

---

Note

Medium Risk
Changes how CI/policy pass-fail is computed for scan reports, so behavior may differ if API-resolved actions diverge from the old client-side policy lookup.

Overview
scan report now judges policy health from each alert’s resolved action on the full-scan API response instead of fetching org security policy and mapping alert types to rules locally.

That removes the extra getOrgSecurityPolicy call, simplifies fetchScanData to a single full-scan request, and drops the security-policy:read permission and second API quota unit for this command (updated in requirements.json and help text). generateReport no longer takes a policy object; alerts without a resolved action are ignored.

New fetch-report-data tests and updated report tests cover the new data path and grading behavior.

^{Reviewed by Cursor Bugbot for commit 3ca1ccc. Configure here.}