Add XploitScan to Bitbucket Pipelines

# bitbucket-pipelines.yml
# Scans on every pull request and on commits to main. Uses the
# standard Node.js image; no custom Docker image needed.

image: node:20-alpine

definitions:
  steps:
    - step: &xploitscan
        name: XploitScan Security Scan
        script:
          - npm install -g xploitscan@^1.0.0
          - npx xploitscan@latest scan . --format json --no-ai > xploitscan-results.json || true
          - npx xploitscan@latest scan . || true  # human-readable output in the pipeline log
          # Fail if any critical findings are present. To block on
          # high-severity too: grep -qE '"severity": "(critical|high)"'
          - |
            if grep -q '"severity": "critical"' xploitscan-results.json; then
              echo "Critical vulnerability detected — failing pipeline"
              exit 1
            fi
        artifacts:
          - xploitscan-results.json

pipelines:
  pull-requests:
    '**':
      - step: *xploitscan
  branches:
    main:
      - step: *xploitscan

# In Bitbucket: Repository settings → Repository variables →
# Add secured variable:
#   Name:  XPLOITSCAN_API_KEY
#   Value: xpls_...
#   Secured: yes
#
# The CLI auto-reads the env var. No change to the YAML is needed.