docs(agents): add security advisory comment workflow via gh api

Document replying to security advisories through comments instead of
editing the advisory description, including the gh api commands to
list and post comments and the note that comments cannot be deleted.

AGENTS.md

@@ -197,6 +197,7 @@ Before you rate a vulnerability or write an advisory, find the security boundary
 - If a path is reachable by a member only because of a different missing authorization check, report that check as the main issue, with high severity. Rate each injection behind it by the role it needs when the check works.
 - Always fix low-severity findings (escape shell arguments, validate input, confine paths) when you find them. Do not dismiss them because the attacker is an admin.
 - Do not put exploit details, payloads, or unreleased advisory IDs in commits, PR descriptions, code comments, or this file.
+- To reply on a security advisory, add a comment. Do not edit the advisory description. Comments API (public preview): `gh api repos/coollabsio/coolify/security-advisories/<GHSA-ID>/comments` lists comments, and `gh api -X POST repos/coollabsio/coolify/security-advisories/<GHSA-ID>/comments -F body=@comment.md` adds one. The API cannot delete comments.
 
 ### Event Broadcasting
 - Laravel Reverb WebSocket server for real-time updates (port 6001) and a Node terminal WebSocket server (port 6002), both run inside the `coolify` container as s6 services