Add invoice email link security skill

[YfengJ]

Summary

• Add invoice-email-link-security under Identity & Access for reviewing invoice, billing, and payment email links.
• Cover token authority, recipient/account/tenant binding, forwarding safety, replay controls, redirect/referrer/Host header leakage, and step-up before sensitive financial actions.
• Add vulnerable and benign fixtures, then update README and index discovery from 45 to 46 skills.

Closes #2418

Requested bounty

Requested author bounty: Intermediate (USD 350) if accepted. Payment details can be provided privately after maintainer acceptance.

Validation

• git diff --check
• find tests skills/identity/invoice-email-link-security -name '*.json' -print0 | xargs -0 -n1 jq empty
• frontmatter required-field check for skills/identity/invoice-email-link-security/SKILL.md
• Markdown fence balance check
• scoped README/index discovery checks for the new skill entry

Note: full YAML parsing of index.yaml is blocked by an existing unquoted ISO/IEC-27001:2022 value in the base file, so I used scoped checks that validate this PR's new entry without changing unrelated existing metadata.