feat(gitlab): expose automatic_security_review input (A1, per-MR scope)

Wires the automatic_security_review toggle through the GitLab CI/CD Component. When set to "true", the security-reviewer subagent already bundled in .factory/droids/security-reviewer.md is spawned in parallel with the code-review subagents during Pass 1 (the conditional block in src/gitlab/prompts/candidates.ts already handles this via the securityReviewEnabled flag). Security findings are prefixed with [security] and flow through the same Pass-2 validator path as code-review findings, ultimately posted via a single batched submit_review call.

No plugin install is required: the security-review skill that the subagent invokes as its first action is built into the Droid CLI binary. Mirrors the GitHub action's automatic_security_review input for the per-MR flow only; the scheduled full-repo scan (which additionally uses threat-model-generation / commit-security-scan / vulnerability-validation skills from the security-engineer plugin) is a separate feature.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

Author: factory-nizar

gitlab/templates/review.yml

@@ -18,6 +18,15 @@ spec:
         high-confidence. Set to "false" to disable suggestion blocks
         entirely. Mirrors the GitHub action's `include_suggestions` input.
       default: "true"
+    automatic_security_review:
+      description: |
+        Automatically run a security-focused review subagent in parallel
+        with the regular code review on every MR pipeline. Findings are
+        prefixed with `[security]` and posted alongside code-review
+        comments. Mirrors the GitHub action's `automatic_security_review`
+        input. The security-review skill is built into the Droid CLI; no
+        plugin install is required.
+      default: "false"
     settings:
       description: |
         Droid Exec settings as a JSON string or a path to a JSON file.
@@ -57,6 +66,7 @@ droid-review:
     REVIEW_MODEL: "$[[ inputs.review_model ]]"
     REASONING_EFFORT: "$[[ inputs.reasoning_effort ]]"
     INCLUDE_SUGGESTIONS: "$[[ inputs.include_suggestions ]]"
+    AUTOMATIC_SECURITY_REVIEW: "$[[ inputs.automatic_security_review ]]"
     DROID_SETTINGS: "$[[ inputs.settings ]]"
     DROID_SUCCESS: "true"
   before_script: