Show security upgrade insights in DevTools (#99002)
Stacked on #99222.
### Why?
Developers running `next dev` with `agenticAutoUpgrade` enabled need a
browser reminder when their installed Next.js version is affected by a
security advisory.
### How?
Assess upgrades once during dev startup and share the result with the
CLI nudge. The existing HMR `SYNC` message carries the security advisory
to DevTools, which shows a Vulnerability Insight in the existing
Insights overlay with a copyable upgrade prompt.
The Insight applies to the `security`, `latest`, and `future` policies
when the assessment finds an affected version and a safe target. A
private test override previews the UI without a vulnerable fixture or
live advisory data.
### Screenshots
These show the badge and overlay layout. The current copied prompt runs
`next upgrade --ai=security` from the app directory.
**DevTools badge**
| Light | Dark |
| --- | --- |
| 
| 
|
<!-- NEXT_JS_LLM -->
Closes NAR-939
