Migrate AquaSec security issues from type:tech-debt to a dedicated type:aquasec label

[tmikula-dev]

BLOCKED - waits for quite some time to let other teams to finish migration Phase 1

Feature Description

Replace the generic type:tech-debt label on AquaSec-generated security issues with a dedicated type:aquasec label, and narrow the issue-fetch filter to require both scope:security and type:aquasec.

Problem / Opportunity

AquaSec issues are currently labelled scope:security + type:tech-debt. type:tech-debt is a general-purpose label that teams also apply to unrelated work, so it cannot be used to identify AquaSec-generated issues.

The sync currently fetches candidate issues by scope:security alone. That is too broad.

Constraint that shapes the design: the fetch decides update vs. create. If the fetch is narrowed to type:aquasec at the same moment the automation starts writing that label, every pre-existing issue (which only carries type:tech-debt) becomes invisible and every finding is re-created as a duplicate. The rollout therefore has to be split into two phases.

Acceptance Criteria

Phase 1 — write the new label, keep reading broadly

1. New parent issues are created with scope:security, type:aquasec, epic; new child issues with scope:security, type:aquasec.
2. Label type:aquasec is auto-created in the target repo (idempotent) so no manual setup is required.
3. Required-label check validates type:aquasec instead of type:tech-debt.
4. A sweep migrates all existing AquaSec issues — including closed ones and ones not matched by a current alert. Adding type:aquasec and removing type:tech-debt.
5. Only issues carrying an AquaSec secmeta block are touched. Manually-created scope:security issues are never modified.
6. Label type:tech-debt is only un-assigned when the issue has both scope:security and type:tech-debt, and the repo-level label definition is never deleted.
7. Already-migrated issues cost zero API calls, so the sweep converges and nightly runs stay cheap.
8. The fetch filter is unchanged (scope:security only).

Phase 2 — narrow the fetch, remove scaffolding (separate PR, ~1 month later)

9. Fetch requires both scope:security and type:aquasec.
10. All migration scaffolding is removed; grep -rn "MIGRATION-PHASE-2" src/ tests/ returns nothing.
11. type:aquasec documented as a prerequisite label (auto-create removed).

Dependencies / Related

Phase 2 must not be merged until every consuming repo has had a successful run in the migration window.

This issue stays open after the Phase 1 PR merges; it is closed by the Phase 2 PR.