Returns the integration's repo allow/deny scan policy. mode is null when no policy is configured (scan everything); an allow policy with an empty fullNames means scan nothing. Returns 422 (not_scannable_integration) for non-scannable integration types.