[Updater] Extract RefreshSecurityUpdatePullRequest into an Operation class

[brrygrdn]

Follows on from #6866, #6884, #6939, #6961

This branch is the last of four class extractions to peel out the distinct scenarios the Updater actually handles today in clear terms.

Changes

This branch peels out the Updater code required to accept a job which is refreshing a Dependabot PR for a security update using the typical approach of:

• Extract the entire code path required from the Updater
• Remove any code related to non-concerns for this operation type, in this case version updates and rebases
• Wire it into the Updater to be used for a specific job type, verifying current testing passes

The one deviation is that in the initial commit, I've extracted all Security-related helpers into a mixin to encapsulate and avoid duplicating them since they are identical between the "Create" and "Refresh" scenarios. This also affords removing them from the legacy codeline and adding the mixin instead.

For reference, this class is basically a remix of those introduced in #6939 and #6939

What's next

With this PR, every job we run should now be going through one of the four updater classes instead of the Updater#legacy_run method.

I intend to create a PR that branches from this to delete that code and mop up any test cases that are falling into implicit cases we don't actually run in the real world, but I plan to ship this to verify that no production jobs are leaking into the legacy code first as that could change the remaining scope as it might mean our analysis has some gaps.

[jakecoffman]

LGTM!