Make trusted-scanner-bot allowlist configurable

[JSONbored]

Context

Part of the review-stack architecture audit (parent epic — hardcoding dimension).

src/github/backfill.ts:3846-3847:

// External scanner GitHub App bot logins allowed to create review-thread blockers.
const TRUSTED_SCANNER_REVIEW_THREAD_AUTHORS = new Set(["superagent[bot]", "superagent-security[bot]",
  "superagent-security-dev[bot]", "brin[bot]"]);

Consumed by isAuthorizedReviewThreadAuthor (backfill.ts:3793-3806), which feeds
fetchLiveReviewThreadBlockers (docstring: "Only maintainer/collaborator comments or known scanner-bot
comments can create blockers") → buildReviewThreadBlocker → REVIEW_THREAD_BLOCKER_CODE = "review_thread_unresolved", a real deterministic gate blocker.

Impact

Any self-hoster using a different third-party scanner (CodeQL, Snyk, Semgrep, SonarCloud, DeepSource,
etc. — extremely common) gets that scanner's unresolved review threads silently ignored by the gate
(their comments don't have OWNER/COLLABORATOR association, so they fall through every trust check and
never block), while the four JSONbored-chosen bots are the only ones ever recognized.

Fix

Additive env var, e.g. TRUSTED_SCANNER_BOT_LOGINS (comma-separated, merged with the built-in defaults)
— same shape as GITTENSORY_DRIFT_ISSUE_ASSIGNEES (src/upstream/ruleset.ts:1157-1164) or
DISCORD_REPO_WEBHOOKS (src/services/notify-discord.ts).

Acceptance criteria

• A self-hoster can add their own scanner bot logins via env var without code changes.
• Built-in defaults (the 4 existing bots) remain recognized unless explicitly overridden.
• Documented in the self-host env reference (npm run selfhost:env-reference).

[linear-code]

JSO-3402