A Scalable Game-Theoretic Approach for Selecting Security Controls from Standardized Catalogues (Logical Methods in Computer Science, 2026)