Returns the repo allow/deny scan policy of the account the integration connects; every connection on one account shares it. mode is null when no policy is configured (scan everything); an allow policy with an empty fullNames means scan nothing. Returns 422 (not_scannable_integration) for integrations that are not source control, 422 (scan_policy_account_unknown) when the connected account is not recorded. When the connection names several accounts whose policies differ, answers with the combination that scans the least and accountsDiffer: true; combined deny lists can then name more repos than PUT accepts.