Implement MongoDB-based storage for Pack Run approval, artifact, log, and state management

- Added MongoPackRunApprovalStore for managing approval states with MongoDB.
- Introduced MongoPackRunArtifactUploader for uploading and storing artifacts.
- Created MongoPackRunLogStore to handle logging of pack run events.
- Developed MongoPackRunStateStore for persisting and retrieving pack run states.
- Implemented unit tests for MongoDB stores to ensure correct functionality.
- Added MongoTaskRunnerTestContext for setting up MongoDB test environment.
- Enhanced PackRunStateFactory to correctly initialize state with gate reasons.

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ScannerSurfaceSecretConfiguratorTests.cs

@@ -30,7 +30,10 @@ public sealed class ScannerSurfaceSecretConfiguratorTests
         """;
 
         using var handle = SurfaceSecretHandle.FromBytes(Encoding.UTF8.GetBytes(json));
-        var secretProvider = new StubSecretProvider(handle);
+        var secretProvider = new StubSecretProvider(new Dictionary<string, SurfaceSecretHandle>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["cas-access"] = handle
+        });
         var environment = new StubSurfaceEnvironment();
         var options = new ScannerWebServiceOptions();
 
@@ -82,17 +85,101 @@ public sealed class ScannerSurfaceSecretConfiguratorTests
         Assert.Equal("X-Sync", storageOptions.ObjectStore.RustFs.ApiKeyHeader);
     }
 
+    [Fact]
+    public void Configure_AppliesAttestationSecretToSigning()
+    {
+        const string json = """
+        {
+          "keyPem": "-----BEGIN KEY-----\nYWJj\n-----END KEY-----",
+          "certificatePem": "CERT-PEM",
+          "certificateChainPem": "CHAIN-PEM"
+        }
+        """;
+
+        using var handle = SurfaceSecretHandle.FromBytes(Encoding.UTF8.GetBytes(json));
+        var secretProvider = new StubSecretProvider(new Dictionary<string, SurfaceSecretHandle>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["attestation"] = handle
+        });
+        var environment = new StubSurfaceEnvironment();
+        var options = new ScannerWebServiceOptions();
+
+        var configurator = new ScannerSurfaceSecretConfigurator(
+            secretProvider,
+            environment,
+            NullLogger<ScannerSurfaceSecretConfigurator>.Instance);
+
+        configurator.Configure(options);
+
+        Assert.Equal("-----BEGIN KEY-----\nYWJj\n-----END KEY-----", options.Signing.KeyPem);
+        Assert.Equal("CERT-PEM", options.Signing.CertificatePem);
+        Assert.Equal("CHAIN-PEM", options.Signing.CertificateChainPem);
+    }
+
+    [Fact]
+    public void Configure_AppliesRegistrySecretToOptions()
+    {
+        const string json = """
+        {
+          "defaultRegistry": "registry.example.com",
+          "entries": [
+            {
+              "registry": "registry.example.com",
+              "username": "demo",
+              "password": "secret",
+              "scopes": ["repo:sample:pull"],
+              "headers": { "X-Test": "value" },
+              "allowInsecureTls": true,
+              "email": "demo@example.com"
+            }
+          ]
+        }
+        """;
+
+        using var handle = SurfaceSecretHandle.FromBytes(Encoding.UTF8.GetBytes(json));
+        var secretProvider = new StubSecretProvider(new Dictionary<string, SurfaceSecretHandle>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["registry"] = handle
+        });
+        var environment = new StubSurfaceEnvironment();
+        var options = new ScannerWebServiceOptions();
+
+        var configurator = new ScannerSurfaceSecretConfigurator(
+            secretProvider,
+            environment,
+            NullLogger<ScannerSurfaceSecretConfigurator>.Instance);
+
+        configurator.Configure(options);
+
+        Assert.Equal("registry.example.com", options.Registry.DefaultRegistry);
+        var credential = Assert.Single(options.Registry.Credentials);
+        Assert.Equal("registry.example.com", credential.Registry);
+        Assert.Equal("demo", credential.Username);
+        Assert.Equal("secret", credential.Password);
+        Assert.True(credential.AllowInsecureTls);
+        Assert.Contains("repo:sample:pull", credential.Scopes);
+        Assert.Equal("value", credential.Headers["X-Test"]);
+        Assert.Equal("demo@example.com", credential.Email);
+    }
+
     private sealed class StubSecretProvider : ISurfaceSecretProvider
     {
-        private readonly SurfaceSecretHandle _handle;
+        private readonly IDictionary<string, SurfaceSecretHandle> _handles;
 
-        public StubSecretProvider(SurfaceSecretHandle handle)
+        public StubSecretProvider(IDictionary<string, SurfaceSecretHandle> handles)
         {
-            _handle = handle;
+            _handles = handles ?? throw new ArgumentNullException(nameof(handles));
         }
 
         public ValueTask<SurfaceSecretHandle> GetAsync(SurfaceSecretRequest request, CancellationToken cancellationToken = default)
-            => ValueTask.FromResult(_handle);
+        {
+            if (_handles.TryGetValue(request.SecretType, out var handle))
+            {
+                return ValueTask.FromResult(handle);
+            }
+
+            throw new SurfaceSecretNotFoundException(request);
+        }
     }
 
     private sealed class StubSurfaceEnvironment : ISurfaceEnvironment