chore(scc): bump version to 0.2.0, fix SetMuteRequest, and add unit test suite

[dandye]

Summary

Bumps scc-mcp to v0.2.0 to release the Security Command Center API v2 upgrade, organization-level findings support, new MCP tools, and unit testing suite.

---

What's Changed

1. SCC API v2 Migration (#274, #167)

• Modernized Client: Migrated from deprecated google.cloud.securitycenter to google.cloud.securitycenter_v2.
• Location-Aware Routing: Added location: str = "global" parameter to all tools, constructing canonical v2 parent and finding resource paths (/locations/{location}).
• Attack Exposure Structure: Updated attack exposure score extraction to map from the nested v2 message structure (finding.attackExposure.score).

2. Organization-Level Findings Support (#249, #248, #274)

• Added organization_id: str = None alongside project_id: str = None across all 6 FastMCP tools and _build_parent.
• Queries findings across all projects in a GCP Organization (organizations/{org_id}/sources/-/locations/{location}) and scopes Cloud Asset Inventory (CAI) searches to organizations/{org_id}.

3. 4 New FastMCP Tools (#274)

1. search_findings: Universal finding search supporting all 9 finding classes (VULNERABILITY, THREAT, MISCONFIGURATION, OBSERVATION, SCC_ERROR, POSTURE_VIOLATION, TOXIC_COMBINATION, SENSITIVE_DATA_RISK, CHOKEPOINT), severities, categories, and mute states.
2. get_finding_details: Comprehensive finding metadata lookup including MITRE ATT&CK tactics/techniques, CVEs, compliance benchmarks, and optional Cloud Asset Inventory (CAI) enrichment.
3. search_findings_by_compliance: Search findings by compliance frameworks (CIS GCP Benchmarks, PCI-DSS, NIST 800-53, ISO 27001) or free-text search across descriptions and categories.
4. set_finding_mute: Mute or unmute findings (MUTED / UNMUTED) with canonical name resolution.

4. Bug Fixes and Improvements

• Attack Exposure Sorting Fix (feat(scc): migrate to SCC v2 API, add new finding tools, fix sorting and mute #274): top_vulnerability_findings over-fetches a larger candidate pool (up to 1,000) so sorting by attack exposure score is accurate across the full population rather than just the first 20 records.
• Inline Remediation Steps (feat(scc): migrate to SCC v2 API, add new finding tools, fix sorting and mute #274): top_vulnerability_findings returns nextSteps inline.
• Case-Insensitive OR Filter ([scc-mcp] _build_or_filter fails on lowercase or mixed-case 'or' values due to case-sensitive split #298, feat(scc): migrate to SCC v2 API, add new finding tools, fix sorting and mute #274): Fixed _build_or_filter to use re.split(r'\s+or\s+|,', ...) supporting lowercase, mixed-case, and comma-separated filter clauses.
• SetMuteRequest Class Reference: Fixed protobuf request instantiation in set_finding_mute.
• Dynamic Exception Target Labels ([scc-mcp] Error messages in NotFound exception handlers format project_id as None when querying by organization_id #296, feat(scc): migrate to SCC v2 API, add new finding tools, fix sorting and mute #274): Handled NotFound errors dynamically based on whether querying by project or organization.

5. Unit Test Suite

• Added server/scc/tests/test_scc_unit.py with 10 unit tests covering _build_parent, _build_or_filter, search_findings, get_finding_details, search_findings_by_compliance, top_vulnerability_findings, get_finding_remediation, and set_finding_mute.

---

Verification

• pytest server/scc/tests/test_scc_unit.py (10 passed in 1.30s)