perf(rees): add shared analysis context and request caches

[JSONbored]

Context

REES analyzers repeatedly parse the same PR inputs and independently call the same external services. That makes full runs more expensive than they need to be and makes analyzer fanout harder to control.

This issue introduces a shared request-scoped context that analyzers can use for parsed PR state, reusable external clients, caches, and safe metrics.

Parent: #1499

Deliverables

• Add an AnalysisContext or equivalent request-scoped object for REES analyzer execution.
• Parse common inputs once: changed files, added lines, patch hunks, dependency manifests, package changes, file categories, and repo/PR identity.
• Provide shared GitHub, npm, PyPI, OSV, deps.dev, and endoflife clients where applicable.
• Add request-scoped caching and in-flight de-duplication for identical external lookups.
• Expose safe metrics counters: cache hits, cache misses, external calls by category, skipped work, capped work, and elapsed time.
• Migrate a representative set of analyzers to consume the shared context.

Requirements

• Preserve current analyzer output shape unless an explicitly versioned additive field is introduced.
• Respect the parent request abort signal and remaining budget.
• Keep caches request-scoped unless a later issue explicitly adds process-level TTL caches.
• Do not log or report raw diffs, request bodies, prompts, comments, tokens, or private configs.

Acceptance criteria

• At least one local analyzer and one external-call analyzer use the shared context.
• Duplicate package/GitHub lookups within a single request are de-duplicated.
• Metrics are safe to emit to Sentry or response diagnostics without leaking sensitive payloads.
• Existing REES behavior remains compatible with the engine.

Validation

• Focused REES tests covering shared context parsing and request-cache behavior.
• Existing analyzer tests for migrated analyzers.
• A regression test proving duplicate external lookups are not repeated inside one request.

Ownership

Maintainer-only. No gittensor:* labels.