feat(codacy-skills): document affected functions for SCA issues/findings

[claudiacodacy]

Summary

issues/issue/findings/finding in the Codacy Cloud CLI now surface the affected functions of a linked advisory (CVE or GHSA) when Codacy has identified them (codacy-cloud-cli#34, merged, part of OD-296). This updates the codacy-cloud-cli skill so an agent knows this data exists and how to act on it.

• Notes the compact Vulnerable functions: fn1, fn2 (+N more) line and the full Vulnerable Functions (<advisoryId>) detail block for both the Issues and Security findings sections.
• Adds a "Check whether a vulnerable dependency is actually reachable" entry to Common workflows, since this is the same reachability check the product's own "Check if you're affected" UI feature asks users to run with a coding agent.
• Bumped version to 1.6.0 per CONTRIBUTING.md.

Companion docs-site PR: codacy/docs#2716 (still draft — pending GHSA support and feature-flag removal on the web UI side; the CLI feature itself is already merged and unaffected by that).

[claudiacodacy]

Suggested change

**Affected functions:** for SCA issues linked to an advisory (CVE or GHSA) with known affected functions, `issues`/`issue` show them alongside the regular output — a compact `Vulnerable functions: fn1, fn2 (+N more)` line on list/card views, and a full `Vulnerable Functions (<advisoryId>)` block with published date on `codacy issue` detail views. Always included in `--output json` when present. Use this to tell a user exactly which functions a vulnerability affects, so they (or their coding agent) can check whether their code actually calls them before deciding to upgrade the dependency or ignore the finding as `NotExploitable`.

**Affected functions:** for SCA issues linked to an advisory (CVE or GHSA) with known affected functions, `issues` and `findings` show them alongside the regular output — a compact `Vulnerable functions: fn1, fn2 (+N more)` line on list/card views, and a full `Vulnerable Functions (<advisoryId>)` block with published date on `codacy issue` and `codacy finding` detail views. Always included in `--output json` when present. Use this to tell a user exactly which functions a vulnerability affects, so they (or their coding agent) can check whether their code actually calls them before deciding to upgrade the dependency or ignore the finding as `NotExploitable`.

[claudiacodacy]

Validated the documented output against live data (codacy-cloud-cli 1.7.0, org `codacy`), not just the source PRs:

Card views — `codacy issues gh codacy codacy-remark-lint --tools trivy`:
```
Vulnerable functions: matchOne, minimatch
Vulnerable functions: v3, v5, v6 (+3 more)
```

Detail views — `codacy issue gh codacy codacy-remark-lint 131358696592` and `codacy finding gh codacy 86fb4b06-beca-4f88-b4d4-3ca6ee5d3872` (no linked issue) both render:
```
Vulnerable Functions (CVE-2024-4067)
Published: 2024-05-13

• micromatch.braces
```

Also confirmed `--ignore-reason` accepts `NotExploitable` via `codacy issue --help`.

All matches what's now documented in this PR. No discrepancies found.