feat: add --ignore-file for path-based finding suppression

[elfrost]

Summary

New `scanner/ignore.py` module + `--ignore-file PATH` CLI flag for `.gitignore`-style suppression of findings by repo-relative path. Closes the recurring backlog item observed across all four public scans:

Scan	FPs that would benefit
gptme	`tests/test_onboard.py` (sk-test placeholder)
openllmetry	`packages//tests/cassettes/` (25 cassette "secrets")
agentic_security	`tests/**/test_pii_detector.py`, `tests/unit_tests/test_security.py` (detector fixtures)
Upsonic	`tests/unit_tests/safety_engine/`, `tests/smoke_tests/integrations/langfuse/`

How it works

• Patterns are matched against the rebased repo-relative POSIX path, so `tests/**` works as expected regardless of where the temp clone landed.
• Standard `.gitignore` syntax via `pathspec` (`#` comments, `!` negation, `**` recursive).
• Findings with an empty `file` field (info-level "tool not installed" placeholders) are never suppressed — they describe infrastructure state, not file content, and a `**` pattern should not silently drop them.

Validation

Re-scanned Upsonic with an ignore file targeting their safety-engine + smoke-test fixtures:

• Before: 21 high, 19 medium = 40 findings
• After: 13 high, 19 medium = 32 findings (8 FPs suppressed, 4 real items preserved)

Test plan

• 11 new tests in `tests/test_ignore.py` covering: comment parsing, negation, deep `**` matching, order preservation, empty-file safety
• Full suite: 264 passed, ruff clean, black clean
• End-to-end re-scan on Upsonic confirms 8 FPs suppressed without losing real items

🤖 Generated with Claude Code