Add a tool to return not only the scores themselves but also the reason for any deductions

[tats-u]

The socket.dev website displays scores along with reasons for deductions (e.g., known malware, eval function usage), but this MCP server only provides scores for the given packages.

When an AI agent attempts to access the socket.dev site to verify deduction reasons, it receives a 403 error. This leaves the AI agent with no means whatsoever to check deduction reasons.

[samarth70]

I've opened a PR for this. depscore was calling /v0/purl with alerts=false, so only scores came back with no way to see why one was low. The PR requests alerts=true and appends a compact, deduplicated Alerts: line to each package — naming the alert types with severity (e.g. malware (critical), usesEval (middle)), capped with a +N more overflow so it doesn't flood the agent's context. Happy to adjust the format or gate it behind a flag if you'd prefer.