Fix builtin_scan to respect ScanScope (--staged/--range)

[kimdzhekhon]

Summary

• builtin_scan() had no scope parameter and always walked the entire target tree, so --staged (and --range) still let the always-on built-in scanner flag secrets in unstaged/untracked files — breaking the "only check what I'm about to commit" contract.
• builtin_scan now takes scope: &ScanScope and branches the same way try_gitleaks/try_trufflehog already do: Staged scans only git diff --cached --name-only output, Range scans only git diff --name-only <range> output, Filesystem/History keep the existing full working-tree walk (builtin has no historical-content path).
• Extracted the per-file scan logic into scan_file_into so the size-cap/binary/UTF-8 filters and match logic stay identical across the walk-based and git-file-list-based branches.

Fixes #20

Test plan

• cargo test — 25/25 pass, including new builtin_scan_staged_scope_only_scans_staged_files regression test (asserts a secret in an unstaged file is not reported under ScanScope::Staged, only the staged file's secret is; sanity-checks Filesystem scope still sees both).
• cargo build --all-targets
• cargo fmt --all -- --check
• cargo clippy --all-targets — no new warnings; the 10 pre-existing warnings (8 &PathBuf/&Path in main.rs, Default derive + hash_one in untouched scanners.rs lines) are unchanged from main and out of scope for this fix.