feat: implement PR review pipeline with Gitea/GitHub/GitLab webhooks

On PR open/sync, webhook triggers incremental scan: runs semgrep on
changed files + LLM code review on the diff, then posts review comments
via the configured tracker. Adds Gitea webhook handler with HMAC-SHA256
verification, and wires up the previously stubbed GitHub/GitLab PR
handlers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

compliance-core/src/config.rs

@@ -14,6 +14,7 @@ pub struct AgentConfig {
     pub gitlab_url: Option<String>,
     pub gitlab_token: Option<SecretString>,
     pub gitlab_webhook_secret: Option<SecretString>,
+    pub gitea_webhook_secret: Option<SecretString>,
     pub jira_url: Option<String>,
     pub jira_email: Option<String>,
     pub jira_api_token: Option<SecretString>,