Phase 2c: add --format and --output-dir flags for report selection

[advaitpatel]

Summary

Adds --format and --output-dir so users can choose which report formats are
written and where, instead of always generating all four (json/csv/pdf/html) to the
default results directory. Third of the Phase 2 sequence.

Changes

• --format <list>: comma-separated subset of json,csv,pdf,html. Validated and
  normalized to canonical order. Invalid values exit 2.
• --output-dir <dir>: overrides the report destination for the run (compose and
  non-compose scans). Also used as the AI-findings report-path hint and shown in the
  run banner.
• ReportGenerator.generate_all_reports and DockerSecurityScanner.generate_all_reports
  both accept an optional formats list; None preserves the existing "write
  everything" default.

Notes

• No default behavior change: omitting both flags still writes all four formats to
  the usual results directory.
• CSV still writes header-only content on zero vulnerabilities when csv is among the
  requested formats — unchanged data behavior, just now skippable via --format.

Testing

• ruff check . passes.
• pytest: 119 passed (+5: format-subset generation tests, invalid --format, and
  --format/--output-dir threading through the CLI).
• Manual runs verified: default (all four), --format json,html (only those two on
  disk), --output-dir (files land in the custom directory), invalid --format (exit 2).