v1.1.0

Heads up for CI users: invalid input (unknown --fail-on-severity, empty before sample, zero rules, malformed YAML) now exits 2 instead of 0.

• Security: the reusable Action now passes its inputs to the shell through environment variables, so a crafted before, after, rules, fail-on-* or dialect value can no longer inject shell commands.
• Exit code change: diff now exits 2 (was 0) for an unknown --fail-on-severity value, a before sample with no fields, a rules path with zero rules, or malformed rule YAML; fields exits 2 on malformed YAML. CI that relied on these passing silently will now fail.
• Sigma: direct children of detection are treated as selection ids, not field paths. KQL/SPL: fields compared with no-space symbol operators and whitespace-separated table/field lists are now extracted, so removed fields are reported as IMPACTED instead of false SAFE.
• propose no longer rewrites text inside YAML block scalars (| / >), such as descriptions.
• SARIF artifact URIs are now relative to the working directory (repo root in CI) instead of to --rules, so code scanning links point at the right file.