Add gcp-apigee-security-config CodeBundle

[rw-codebundle-agent]

Summary

Adds the gcp-apigee-security-config CodeBundle to rw-cli-codecollection, implementing the design spec from #157.

This bundle monitors the security posture and access configuration of an Apigee organization:

• Keystore & TLS alias expiry — flags expired or expiring aliases per environment.
• API product quota/rate limits — flags products with no quota, excessive quota, or auto-approval.
• Developer app access scope — flags over-broad scopes and inactive consumer keys.
• Apigee security score/incidents — queries Cloud Monitoring for apigee.googleapis.com/security/* metrics.
• Target server / virtual host configuration — flags plaintext target servers.
• Security summary — aggregates all findings with an overall verdict.

Includes an in-repo sli.robot (0-1 health score across 5 dimensions), generation rules, SLX/taskset/SLI templates, README, SKILL-TEMPLATE, and .test/ infrastructure (Taskfile + Terraform).

Scorer

python -m scorer.score → 104/104, no critical failures.

Deviations from the design spec (validated against the Apigee Admin API)

• Certificate expiry field: the spec referenced alias certInfo.validTo; the actual API field is certsInfo.certInfo[].expiryDate (milliseconds since epoch). The bundle uses expiryDate.
• Virtual hosts: the Apigee Admin API exposes no public REST endpoint for enumerating virtual hosts. The target/vhost task focuses on target servers (documented endpoint) and performs only a best-effort virtual-host check without raising false issues.
• Target-server TLS field: the API uses the oddly-cased sSLInfo.enabled.
• Keystores/target servers are environment-scoped; scripts iterate the org's environments.
• Security metrics (security/score, security/incident_request_count, security/detected_request_count) were confirmed, but only populate when Advanced API Security is enabled; the score check raises no issue when no data is returned.

[Rohit-Ekbote]

Closing as a duplicate of #733.

The creator bot opened this spec twice — once on codebundle/gcp-apigee-security-config, once on creator/issue-157. Both PRs point at the same single commit d3988560, so the diffs are byte-identical (+1865/-0 across 23 files).

Keeping #733, since creator/issue-N is the branch every merged Apigee bundle came from (#744, #745, #746, #748). The gcp-apigee-security-config work itself is still wanted — the Advanced API Security score/incident checks and the product quota / app-scope checks have no equivalent on main. Review continues on #733.

No content is lost by this close.