feat: add getApprovals to PhishingController

[AugmentedMode]

Summary

• Adds getApprovals method to PhishingController that wraps the security alerts API POST /address/evm/approvals endpoint (Blockaid's approvals endpoint)
• Returns token approvals for an EVM address with security enrichments (verdict, spender info, exposure data, allowance details)
• Follows the existing scanAddress pattern (input validation, chain resolution, safelyExecuteWithTimeout) but intentionally does not cache — the frontend manages state

Changes

• src/types.ts — Added ApprovalResultType/ApprovalFeatureType enums and types: Approval, ApprovalsResponse, Allowance, ApprovalAsset, Exposure, Spender, ApprovalFeature
• src/PhishingController.ts — Added APPROVALS_ENDPOINT constant, PhishingControllerGetApprovalsAction action type, messenger registration, and getApprovals method
• src/index.ts — Exported all new types and enums
• src/PhishingController.test.ts — Added 8 test cases covering: valid response, missing address/chainId, unknown chain, HTTP errors, timeout, address/chainId normalization

---

Note

High Risk
Adds a new external API call path and messenger action, and changes SECURITY_ALERTS_BASE_URL to http://localhost:3000, which could break production requests if not environment-gated.

Overview
Adds a new PhishingController.getApprovals method and messenger action that POSTs to APPROVALS_ENDPOINT to retrieve approval/allowance/exposure/spender enrichment data, with input normalization and a 5s timeout returning { approvals: [] } on errors.

Introduces and exports approval-related enums/types from types.ts, adds comprehensive unit tests for the new method, and updates the package changelog.

Notably changes SECURITY_ALERTS_BASE_URL in PhishingController.ts to http://localhost:3000.

^{Written by Cursor Bugbot for commit ed84f19. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[cursor]

Production URL replaced with localhost debug URL

High Severity

SECURITY_ALERTS_BASE_URL has been changed from the production endpoint https://security-alerts.api.cx.metamask.io to http://localhost:3000. This breaks all security alert functionality in production — not just the new getApprovals method, but also the existing scanAddress and bulkScanTokens methods that rely on the same constant. Additionally, the protocol was downgraded from HTTPS to HTTP.