Add typed JSON output to app security check

`--json` prints one result for the scan: the app, the results directory
and the two files that the scan replaced, its scope and scan
directories, the number of agent checks, and whether `--blocking`
passed. A breach still exits 1, after the result is printed. The result
holds no findings: `review --json` shows them. Paths are absolute, with
native separators.

In a terminal the instructions prompt is still offered, on stderr, with
choices to include the instructions in the result, and to copy them as
well by default. `--print-instructions` includes them without asking. A
failed copy warns on stderr and reports `copied: false`. `--list-files`
lists the gathered files with absolute paths. Declining to scan without
app configuration prints a cancelled result and exits 0. Gathering
warnings and the tip to skip the prompts are events on stderr.

`check` was the last app security command without typed JSON output, so
the exceptions list drops its app security section.

Author: jek

.changeset/app-security-check-json.md

@@ -0,0 +1,6 @@
+---
+'@shopify/app': minor
+'@shopify/cli': minor
+---
+
+Add typed JSON output to `app security check`.

docs-shopify.dev/generated/generated_docs_data_v2.json

@@ -3584,7 +3584,7 @@
           "syntaxKind": "PropertySignature",
           "name": "--list-files",
           "value": "''",
-          "description": "Print the files the check would gather, one path per line, and stop. Nothing is scanned, no results are written, and nothing is prompted for.",
+          "description": "Print the files the check would gather, one path per line, and stop. Nothing is scanned, no results are written, and nothing is prompted for. With --json, the result lists them with absolute paths.",
           "isOptional": true,
           "environmentValue": "SHOPIFY_FLAG_LIST_FILES"
         },
@@ -3629,7 +3629,7 @@
           "syntaxKind": "PropertySignature",
           "name": "--print-instructions",
           "value": "''",
-          "description": "Print coding-agent instructions without prompting for how to deliver them.",
+          "description": "Print coding-agent instructions without prompting for how to deliver them. With --json, the instructions are included in the result.",
           "isOptional": true,
           "environmentValue": "SHOPIFY_FLAG_APP_SECURITY_PRINT_INSTRUCTIONS"
         },
@@ -3668,9 +3668,18 @@
           "description": "The name of the app configuration.",
           "isOptional": true,
           "environmentValue": "SHOPIFY_FLAG_APP_CONFIG"
+        },
+        {
+          "filePath": "docs-shopify.dev/commands/interfaces/app-security-check.interface.ts",
+          "syntaxKind": "PropertySignature",
+          "name": "-j, --json",
+          "value": "''",
+          "description": "Output the result as JSON. Automatically disables color output.",
+          "isOptional": true,
+          "environmentValue": "SHOPIFY_FLAG_JSON"
         }
       ],
-      "value": "export interface appsecuritycheck {\n  /**\n   * The minimum finding severity that causes a non-zero exit code: high, medium, or low. Defaults to none, which never fails on findings.\n   * @environment SHOPIFY_FLAG_APP_SECURITY_BLOCKING\n   */\n  '--blocking <value>'?: string\n\n  /**\n   * The Client ID of your app.\n   * @environment SHOPIFY_FLAG_CLIENT_ID\n   */\n  '--client-id <value>'?: string\n\n  /**\n   * The name of the app configuration.\n   * @environment SHOPIFY_FLAG_APP_CONFIG\n   */\n  '-c, --config <value>'?: string\n\n  /**\n   * Skip paths that match this glob, relative to the working directory. Repeat the flag to add globs. The selected app configuration file can't be excluded.\n   *\n   */\n  '--exclude <value>'?: string\n\n  /**\n   * Also scan this directory, relative to the working directory. Repeat the flag to add directories. Use it for code that lives outside the app directory, such as a backend or a shared library.\n   *\n   */\n  '--include-dir <value>'?: string\n\n  /**\n   * Print the command's JSON schemas.\n   * @environment SHOPIFY_FLAG_JSON_SCHEMA\n   */\n  '--json-schema'?: ''\n\n  /**\n   * Print the files the check would gather, one path per line, and stop. Nothing is scanned, no results are written, and nothing is prompted for.\n   * @environment SHOPIFY_FLAG_LIST_FILES\n   */\n  '--list-files'?: ''\n\n  /**\n   * Disable color output.\n   * @environment SHOPIFY_FLAG_NO_COLOR\n   */\n  '--no-color'?: ''\n\n  /**\n   * Turn off Git ignore rules for every scanned directory, so files that Git ignores are scanned too. Files that Git tracks are always scanned.\n   * @environment SHOPIFY_FLAG_NO_GIT_IGNORE\n   */\n  '--no-git-ignore'?: ''\n\n  /**\n   * Disable interactive prompts and browser authentication.\n   * @environment SHOPIFY_FLAG_NO_INPUT\n   */\n  '--no-input'?: ''\n\n  /**\n   * The path to your app directory.\n   * @environment SHOPIFY_FLAG_PATH\n   */\n  '--path <value>'?: string\n\n  /**\n   * Print coding-agent instructions without prompting for how to deliver them.\n   * @environment SHOPIFY_FLAG_APP_SECURITY_PRINT_INSTRUCTIONS\n   */\n  '--print-instructions'?: ''\n\n  /**\n   * Don't offer the coding-agent instructions after the scan. Use it when you want only the deterministic scan results.\n   * @environment SHOPIFY_FLAG_APP_SECURITY_SKIP_INSTRUCTIONS\n   */\n  '--skip-instructions'?: ''\n\n  /**\n   * Increase the verbosity of the output. May include sensitive data.\n   * @environment SHOPIFY_FLAG_VERBOSE\n   */\n  '--verbose'?: ''\n\n  /**\n   * Scan --path as an app with no app configuration file. Config checks are skipped. Requires --client-id.\n   * @environment SHOPIFY_FLAG_WITHOUT_APP_CONFIG\n   */\n  '--without-app-config'?: ''\n}"
+      "value": "export interface appsecuritycheck {\n  /**\n   * The minimum finding severity that causes a non-zero exit code: high, medium, or low. Defaults to none, which never fails on findings.\n   * @environment SHOPIFY_FLAG_APP_SECURITY_BLOCKING\n   */\n  '--blocking <value>'?: string\n\n  /**\n   * The Client ID of your app.\n   * @environment SHOPIFY_FLAG_CLIENT_ID\n   */\n  '--client-id <value>'?: string\n\n  /**\n   * The name of the app configuration.\n   * @environment SHOPIFY_FLAG_APP_CONFIG\n   */\n  '-c, --config <value>'?: string\n\n  /**\n   * Skip paths that match this glob, relative to the working directory. Repeat the flag to add globs. The selected app configuration file can't be excluded.\n   *\n   */\n  '--exclude <value>'?: string\n\n  /**\n   * Also scan this directory, relative to the working directory. Repeat the flag to add directories. Use it for code that lives outside the app directory, such as a backend or a shared library.\n   *\n   */\n  '--include-dir <value>'?: string\n\n  /**\n   * Output the result as JSON. Automatically disables color output.\n   * @environment SHOPIFY_FLAG_JSON\n   */\n  '-j, --json'?: ''\n\n  /**\n   * Print the command's JSON schemas.\n   * @environment SHOPIFY_FLAG_JSON_SCHEMA\n   */\n  '--json-schema'?: ''\n\n  /**\n   * Print the files the check would gather, one path per line, and stop. Nothing is scanned, no results are written, and nothing is prompted for. With --json, the result lists them with absolute paths.\n   * @environment SHOPIFY_FLAG_LIST_FILES\n   */\n  '--list-files'?: ''\n\n  /**\n   * Disable color output.\n   * @environment SHOPIFY_FLAG_NO_COLOR\n   */\n  '--no-color'?: ''\n\n  /**\n   * Turn off Git ignore rules for every scanned directory, so files that Git ignores are scanned too. Files that Git tracks are always scanned.\n   * @environment SHOPIFY_FLAG_NO_GIT_IGNORE\n   */\n  '--no-git-ignore'?: ''\n\n  /**\n   * Disable interactive prompts and browser authentication.\n   * @environment SHOPIFY_FLAG_NO_INPUT\n   */\n  '--no-input'?: ''\n\n  /**\n   * The path to your app directory.\n   * @environment SHOPIFY_FLAG_PATH\n   */\n  '--path <value>'?: string\n\n  /**\n   * Print coding-agent instructions without prompting for how to deliver them. With --json, the instructions are included in the result.\n   * @environment SHOPIFY_FLAG_APP_SECURITY_PRINT_INSTRUCTIONS\n   */\n  '--print-instructions'?: ''\n\n  /**\n   * Don't offer the coding-agent instructions after the scan. Use it when you want only the deterministic scan results.\n   * @environment SHOPIFY_FLAG_APP_SECURITY_SKIP_INSTRUCTIONS\n   */\n  '--skip-instructions'?: ''\n\n  /**\n   * Increase the verbosity of the output. May include sensitive data.\n   * @environment SHOPIFY_FLAG_VERBOSE\n   */\n  '--verbose'?: ''\n\n  /**\n   * Scan --path as an app with no app configuration file. Config checks are skipped. Requires --client-id.\n   * @environment SHOPIFY_FLAG_WITHOUT_APP_CONFIG\n   */\n  '--without-app-config'?: ''\n}"
     }
   },
   "appsecurityclean": {