feat(scan): add mock_env support for MCP servers requiring env vars

[JAORMX]

Summary

• Adds mock_env field to spec.yaml for MCP servers that require environment variables to start
• Enables security scanning of servers that previously had to use insecure_ignore: true
• Updates run_scan.py to accept config via JSON file and pass --stdio-env args to mcp-scanner

Problem

MCP servers that require environment variables (like SEARXNG_URL, NOTION_TOKEN, etc.) cannot be security scanned because:

1. The scanner starts the server via stdio to discover tools
2. Without required env vars, the server fails to start
3. Previously, we used insecure_ignore: true which completely skips the scan

Solution

Add a mock_env field to spec.yaml that specifies placeholder environment variables to pass to the scanner:

security:
  mock_env:
    - name: SEARXNG_URL
      value: "https://mock-searxng.example.com"
      description: "SearXNG instance URL - mock for scanning"
  allowed_issues: []

Changes

File	Change
scripts/mcp-scan/generate_mcp_config.py	Extract mock_env from spec.yaml and include in JSON output
scripts/mcp-scan/run_scan.py	Add --config flag, read mock_env, pass --stdio-env to scanner
.github/workflows/build-containers.yml	Use config file approach instead of positional args
docs/adding-servers.md	Document mock_env field and usage
scripts/mcp-scan/README.md	Update usage examples

Test plan

• Verify generate_mcp_config.py outputs mock_env field (empty array for existing servers)
• Verify run_scan.py --config works with mock_env
• Verify CI workflow passes
• Test with a server that requires env vars (e.g., mcp-searxng in PR feat: add octocode-mcp and mcp-searxng servers #362)

🤖 Generated with Claude Code

[github-actions]

🔒 MCP Security Scan Results

✅ agentql-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

---

Summary: Scanned 1 MCP server(s), all passed security checks. ✅