Normalize Slack issue severity, and stage the SDK v3.6.0 bump

[lelia]

Draft, because it is staging two things and only one of them can land yet.

Ready now: mid-severity findings were dropped from the Slack summary

Every severity lookup in the Slack reachability formatter is keyed on medium, but middle is what the API sends — it is the value in the OpenAPI spec's SocketIssueSeverity and in the SDK enum. A mid-severity finding therefore missed all of them at once:

• Not counted. severity_counts has no middle key and the increment is guarded by if ... in severity_counts, so the summary always read Medium: 0.
• Excluded from total_findings. Since omitted_count = total_findings - len(selected_vulnerabilities), a batch of mid-severity findings can drive the "and N more" line negative.
• Sorted below low. SEVERITY_ORDER.get(severity, 4) returned the default of 4 against low's 3, so mid-severity findings sank to the bottom and were the first truncated at the block limit.
• Wrong emoji, which is the least of it.

The findings themselves were always listed — purl_groups drives that, not the counts — so this is a wrong summary and wrong ordering rather than a missing finding or a false all-clear.

Fixed by normalizing to one spelling where the alert is read, rather than adding a parallel middle key to four dicts. Messages.map_socket_severity_to_gitlab and the GitLab severity map already accept both forms with a comment calling middle the older format; this formatter never got the same treatment. Worth noting the live spec still lists middle, so it is the current value rather than a legacy one.

Seven regression tests; five of them fail without the one-line change.

Blocked: the socketdev 3.6.0 bump

Waiting on SocketDev/socket-sdk-python#107 to merge and 3.6.0 to publish. Since the pin is exact, socketdev==3.6.0 cannot land here until the package is actually on PyPI.

• socket-sdk-python#107 merged
• 3.6.0 published to PyPI
• bump socketdev==3.5.0 → ==3.6.0 in pyproject.toml, re-run uv lock
• add the changelog entry, mark ready for review

That bump needs no other CLI change. Verified by installing the 3.6.0 branch and running this suite: 392 passed, 2 skipped, no failures. The CLI imports none of the SDK's enum types, and every severity lookup already has a default, so the new fallback members cannot reach an unguarded branch. The gain is that ten purl types — vscode, chrome, edge-extension, firefox-extension and others — stop being reported as unknown.