[khushi-git-7]

Adds ragprobe security garak REPORT.jsonl: it reads a garak run's report and lines garak's results up with RAGProbe's, one row per OWASP risk.

garak tests the model; RAGProbe tests the app around it (documents, tools, defences). With --with reports/security.json, the two sit side by side, so the model layer and the app layer can be read in one table.

How garak's numbers are read

• Only garak's own counts: a detector's fails are hits. Nothing is re-scored; nones stay out of the rate, as in garak.
• A probe counts once, by its detector with the highest hit rate. garak runs several detectors over the same outputs, so adding them up would count each output more than once.
• garak tags probes with OWASP v1.1 (2023); RAGProbe uses 2025, which renumbered the list (v1.1 LLM02 is 2025 LLM05, v1.1 LLM06 is 2025 LLM02, and so on). Each tag maps to the 2025 risk it became; v1.1's Insecure Plugin Design and Model Theft have no 2025 entry and keep their v1.1 names.
• "not probed" is shown where a tool sent nothing for a risk, never as a pass.

Checked

• On real garak 0.17.2 reports from a full probe sweep (the test.Repeat generator): web_injection gives 349/626 for LLM02 and LLM05, the same as summing each probe's worst detector by hand from the report's eval lines.
• tests/test_garak_report.py: the v1.1 to 2025 mapping, a probe with two detectors counted once, an older report with only passed/total, a malformed line, a file with no results, the side-by-side table, and the command end to end. security garak joins the missing-file test in tests/test_cli_errors.py.
• docs/garak.md explains the mapping and what the two columns can and can't be compared on; the README and CHANGELOG link it.