Returns a cursor-paginated list of package PURLs affected by a single supply
chain attack campaign. This is the primary way to retrieve all packages for a
known campaign without an inline, unbounded list on the campaign object.

Pagination follows the same { items, endCursor } envelope as the campaigns
list. Pass the endCursor value back as cursor to fetch the next page.

Authentication: Organization API token, OAuth2, or NextAuth session.
Required token scope: threat-campaigns:list.

This endpoint requires an Enterprise Plan with the Threat Feed add-on.