v0.4.6 — SCAP-grounded AI remediation prompts

For config/service findings (ssh/systemd/ports/webroot), the fix AI step is now
optionally grounded with a vetted remediation snippet retrieved from the host's
own SCAP Security Guide (SSG) XCCDF datastream (the same one scan --compliance
reads) — real peer-reviewed fix scripts already sitting on the host, unused until
now. Lightweight lexical matching only (no ML/embeddings, no fine-tuning): a
candidate rule must clear both a cosine-similarity floor and a minimum number of
distinct overlapping tokens before it's offered to the model as an optional,
adapt-don't-copy reference.

• New vulnscanai/scap_kb.py.
• New config key scap_grounding (default true), CLI flag fix --no-scap-grounding.
• Silent no-op when scap-security-guide isn't installed — same behaviour as before.
• Package/CVE findings (dnf/oscap) are unaffected.
• 293 tests (+16), bandit clean.