[FEATURE] Add optional base-directory allowlist for parseFromFile

[mteu]

Adds an optional path-allowlist to parseFromFile() so callers that pass user-influenced paths can restrict reads to one or more directories.

CycloneDxParserOptions gains a third field alongside maxFileSize and maxNodes:

public function __construct(
    public int $maxFileSize = self::DEFAULT_MAX_FILE_SIZE,
    public int $maxNodes = self::DEFAULT_MAX_NODES,
    public array $allowedBaseDirectories = [],
)

Override the loose default with:

$parser = new CycloneDxParser(
    new CycloneDxParserOptions(allowedBaseDirectories: ['/srv/sboms']),
);

[coveralls]

coverage: 99.013% (+0.1%) from 98.893% — feature/add-path-allowlist into main