Add npmscan plugin (external url source)

[salemalem]

Adds NPMScan as one marketplace.json entry plus a README section. The source is an external url pinned to commit e83bfb4 of salemalem/npmscan-mcp-plugin; nothing is vendored here.

What it does: npm supply-chain checks through NPMScan's hosted, read-only MCP server (https://npmscan.com/api/mcp, streamable HTTP, no sign-in or API key). It flags malware, known vulnerabilities (OSV.dev, GitHub Security Advisories, NVD), typosquats, maintainer takeovers, install scripts and publish provenance, and audits a package.json, lockfile, SBOM or GitHub repo.

What it ships: the MCP server (23 read-only tools) and five skills: dependency-audit, package-trust-check, new-dependency-evaluation, incident-response and ci-pr-gate. It has no hooks, commands or scripts. The repo uses the Claude Code layout (.claude-plugin/, .mcp.json), which Droid translates.

Tested with Droid 0.244.0 against this branch, added as a local marketplace:

• droid plugin install npmscan@<marketplace> --scope user installs successfully.
• droid mcp list shows npmscan http connected [user].
• All five skills are in the plugin cache.

The plugin is MIT licensed. It's also listed in Anthropic's Claude directory, the ChatGPT Apps directory and the official MCP Registry (io.github.salemalem/npmscan).