Recognize CircleCI dependency auditing in App Doctor

[jplhomer]

WHY are these changes introduced?

The dependency-auditing check introduced in #8556 should also recognize auditing configured in CircleCI.

WHAT is this pull request doing?

Extends the existing check to inspect .circleci/config.yml and .circleci/config.yaml for scanner commands and Snyk orb scans in workflow-invoked jobs. Reuses the shared discovery safety checks and bounded command analysis without executing CI commands or making network requests.

Uses CircleCI-specific Zod schemas for invoked jobs, steps, and selected scanner inputs. Includes recognition, discovery, and validation-boundary tests. Unused jobs and orbs do not count as evidence; unsupported invoked commands and checkout paths remain unresolved unless separate recognized evidence covers the app.

How to manually test your changes?

pnpm shopify app doctor --path /path/to/circleci-app --skip-instructions
pnpm shopify app doctor --path /path/to/circleci-app --json --blocking low

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type and added a changeset

[jplhomer]

Superseded by the simplified file-presence check in #8556. We no longer inspect CircleCI workflows or shell commands; standard Dependabot/Renovate configuration filenames are sufficient. The branch is retained for reference.