Record reviewed actions with security risk scores (#40901)

## What changed

- Add optional `call_id` and `action` fields to `SecurityRiskScore` so a persisted score identifies the tool call and bounded action that produced it.
- Populate the fields after Guardian V2 classifies an action while leaving fail-closed and legacy scores without provenance.

## Testing

- Verify scores preserve action details for direct tool calls and nested code-mode calls.
- Verify rollout serialization retains the new fields.

GitOrigin-RevId: fce69af37f368cecf1d9bce42bfc38a969e969b7