feat: extend address scan result

[imblue-dabadee]

Explanation

Expose address_alert_response_flagged_by from the Security Alerts address-scan API through @metamask/phishing-controller.

The controller previously retained only result_type and label, which would drop the new vendor-attribution data from the Security Alerts API before it reached consumers. This change adds the field to the public scan result and address-scan cache, preserving vendor arrays from the API.

The field is always exposed as a string[]. Controller error paths, legacy API responses, and pre-existing cached entries default it to [], keeping the result shape consistent while preserving existing scan behavior.

References

• PSAFE-599

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
Additive extension to address-scan results with empty-array defaults; scan decision logic is unchanged, though TypeScript consumers must accept the new required field on AddressScanResult.

Overview
Adds address_alert_response_flagged_by (string[]) to public AddressScanResult and AddressScanCacheData, so scanAddress no longer drops Security Alerts vendor attribution before returning or caching results.

PhishingController.scanAddress now forwards vendor arrays from the API, stores them in the address-scan cache, and always includes the field on every path (success, cache hit, and errors). Legacy API payloads and older cached entries without the property default to [], keeping the result shape stable.

Tests and the package changelog cover happy path, legacy API/cache behavior, and error responses.

^{Reviewed by Cursor Bugbot for commit 2f2dcfc. Bugbot is set up for automated code reviews on this repo. Configure here.}