Beyond Success Rate: Cost-Aware Evaluation of Offensive and Defensive Security Agents