fix(lockdown): harden pull_request_read get_commits handling

pull_request_read's get_commits method previously returned commit
messages without any lockdown check, unlike get_diff and get_files
which restrict the whole result when the PR author lacks push access.
Commit content is part of the same untrusted head branch as the diff
and file list, so GetPullRequestCommits now reuses
enforcePullRequestLockdown for consistent, fail-closed behavior
without adding a per-commit permission lookup.

Also updates the lockdown documentation in README.md and
docs/server-configuration.md to:
- list pull_request_read:get_diff, get_files, and get_commits among
  the tools that error when the PR author lacks push access (get_diff
  and get_files were already implemented this way but undocumented)
- clarify that lockdown mode is a best-effort content filter to
  reduce prompt-injection risk, not an authorization boundary
- document the existing intentional trusted-bot exception
  (github-actions[bot], copilot) accurately

Fixes #3105

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>