v0.1.4

scan.sh --security: 20 secure-coding signals (deserialization, XML factories, SQL/command construction, mutable statics, native methods, TLS trust, archives, add-opens), comment-aware, covered by a new fixture. java-secure-coding now runs its review through the scanner.