Recognize .mts and .cts TypeScript modules

[shashwat4543]

What changed

Source discovery now treats .mts and .cts files as TypeScript sources, matching Node's
modern ESM/CJS TypeScript module extensions. LANGUAGES[".mts"] and LANGUAGES[".cts"] now
map to "typescript", so existing TypeScript-aware rules (AG002, AG004, AG006, AG007, etc.)
run against these files with no rule-level changes. No user-facing behavior changed for
already-supported extensions.

Threat model or motivation

Projects increasingly split TypeScript sources into .mts (ESM) and .cts (CJS) files,
especially for dual-published Node packages. Previously these were silently skipped during
discovery — meaning unsafe patterns (shell execution, unsafe fetch, missing tool validation,
etc.) inside those files produced no findings. This closes that discovery gap with no change
to trust boundaries or rule logic.

Validation

• Tests cover vulnerable and safe cases
• make check passes
• Documentation/changelog updated when behavior changed
• Fixtures contain no real credentials or private data

Added tests/test_discovery.py (parametrized over .mts/.cts):

• Positive discovery: an unsafe pattern in .mts/.cts is scanned and detected (AG002)
• Language mapping: LANGUAGES[".mts"]/LANGUAGES[".cts"] equal "typescript"
• Exclusion regression: files under default-excluded paths (e.g. node_modules/) are still skipped
• Size-limit regression: oversized .mts/.cts files still respect max_file_size_kb

Updated CHANGELOG.md under [Unreleased] and removed the corresponding entry from
docs/GOOD_FIRST_ISSUES.md since it's now implemented.

Related issue

Closes #11