feat(tronscan): add security checks and validation

[zuojr]

Summary

• Add a read-only security.js command for TronScan account, token, URL, transaction, multi-signature permission, and token-approval security signals.
• Validate TRON Base58Check addresses, token identifiers, transaction hashes, and URLs locally before querying; strip URL query strings and fragments before transmission.
• Return a normalized assessment while preserving the complete upstream response, and report incomplete responses as unknown rather than a clean result.
• Document the new workflow, add offline and live tests, and bump tronscan-skill to 1.1.0.
• Require token identifiers for TRC10/TRC20 address-history queries and refresh their smoke tests to match the current TronScan API contract.

Motivation

The existing skill exposes general TronScan lookups but not the Security Service endpoints. Several security endpoints return default values or omit invalid inputs, so strict local validation is needed to avoid false clean results.

The transfer validation adjustment was found while running the repository's full live smoke suite. The current TronScan endpoints require both the account address and token identifier:

• https://docs.tronscan.org/en/api/wallet/transfer-trc20
• https://docs.tronscan.org/en/api/wallet/transfer-token10

Testing

Commands run from tronscan-skill/:

node --check scripts/security.js
node --check scripts/transfer.js
node --check scripts/test_all.js
node tests/security.test.js
node scripts/test_all.js

Results:

• Offline validation and assessment tests: 11/11 passed
• Live smoke tests across all configured TronScan endpoints: 30/30 passed
• Invalid TRON addresses, transaction hashes, credential-bearing URLs, and transfer calls without required token identifiers were rejected before an API request.
• YAML frontmatter, JSON resources, package/lockfile version consistency, changed-file scope, and git diff --check passed.

Security

• All new API operations are read-only GET requests.
• No wallet, signing, private key, or transaction-broadcast path is introduced.
• URL credentials are rejected; query strings and fragments are removed before transmission.
• no_known_flags is explicitly documented as not being proof that a target is safe.

Related issues

None.

Coordination

PR #70 also touches the tronscan-skill version fields. If it lands first, this branch will need a small rebase/version adjustment.