v0.14.0

What's Changed

• fix: nine false positives from framework and Kotlin/Java interop by @KevinDoremy in #203
• ci: add a CI job so the required check on main actually reports by @KevinDoremy in #204
• ci: bump actions/checkout from 6 to 7 by @dependabot[bot] in #120
• ci: bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #119
• ci: bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #122
• fix: --export-graph lands via rename, never truncates in place by @KevinDoremy in #197
• deps: refresh the lockfile and realign the Cargo.toml floors by @KevinDoremy in #205
• deps: bump quick-xml to 0.41 by @KevinDoremy in #206
• deps: bump ratatui to 0.30 and crossterm to 0.29 by @KevinDoremy in #207
• deps: move config parsing off the archived serde_yaml by @KevinDoremy in #208
• deps: take the serde_yaml_bw security fixes, hold regex at 1.12 by @KevinDoremy in #209
• feat: ship the VS Code extension, with the analyzer bundled by @KevinDoremy in #210
• fix: three false-positive and drift bugs, plus a 4.5x smaller cache by @KevinDoremy in #211
• docs: one detector reference, and the six that were missing from it by @KevinDoremy in #212
• chore: release 0.14.0, and publish crates.io from the release by @KevinDoremy in #213

Full Changelog: v0.13.0...v0.14.0