fix(supply-chain): treat only == / <= as version pins in requirements.txt (#294)

[Mark2Mac]

What

_extract_packages_from_requirements recorded the captured version for any operator, so a floor like pillow>=10.0.0 was stored as the exact release 10.0.0. The OSV/CVE lookup then attributed that release's vulnerabilities to a dependency that pins nothing — a false CRITICAL supply-chain finding.

Only == and <= bind a dependency to a concrete, CVE-checkable release. >=, >, !=, ~= are floors/ranges. The fix applies the same guard already used by _extract_packages_from_setup_py (m.group(2) in ("==", "<=")), so the two extractors agree.

Reproduction (before)

$ printf 'pillow>=10.0.0\n' > requirements.txt && printf -- '---\nname: r\ndescription: r\n---\n' > SKILL.md
$ skillspector scan . --no-llm --format json -o out.json
$ jq -r '.issues[]|select(.category=="Supply Chain")|"[\(.severity)] \(.finding)"' out.json
[LOW] pillow>=10.0.0
[CRITICAL] pillow==10.0.0   # <- the floor, rewritten as a pin, with 10.0.0's CVEs

Test

Added test_extract_packages_requirements_specifier_is_not_a_pin: asserts ==/<= keep the version while >=, ~=, != and bare names yield None. Verified red before the fix (pillow came back '10.0.0'), green after. Full existing suite for the analyzer stays green (320 passed).

Fixes #294