feat(plan): add --only filter for bola/bfla/baseline

[jabrailkhalil]

What & why

Adds the --only <kind> CLI flag so a scan can be restricted to a single test family: bola, bfla, or baseline. This is useful when only one class of checks is needed (e.g. baseline-only self-access validation during setup).

Closes #8

Type of change

• Bug fix
• New feature
• Docs
• Refactor / chore
• Breaking change

What changed

• src/engine/plan.ts: PlanOptions.only plus parseOnlyFilter() which validates the CLI value and raises a clear error listing the allowed kinds.
• src/cli.ts: new --only <kind> option wired into the scan.
• src/engine/run.ts: passes only through to the planner.
• tests/plan.test.ts: coverage for the filter (plan only ever contains the requested kind) and for the invalid-value error.
• README flag table and CHANGELOG updated.

Checklist

• npm test passes (26 tests, was 23)
• npm run typecheck passes
• npm run build passes
• Added/updated tests for the change (no network except the bundled mock server)
• Updated docs (README / CHANGELOG) if behavior or flags changed
• Follows the project principles: no fabricated identifiers/ownership, and mutations stay behind --include-unsafe
• Commits follow Conventional Commits

Output

$ npm run dev -- scan --spec examples/petstore-openapi.yaml --config examples/identities.yaml --dry-run --only bogus
Error: Invalid value for --only: "bogus". Allowed values: bola, bfla, baseline.   (exit 2)

$ npm run dev -- scan --spec examples/petstore-openapi.yaml --config examples/identities.yaml --dry-run --only bola
... only BOLA rows in the report ...

Notes for reviewers

The option is opt-in and changes nothing when omitted, so the default scan behaviour is preserved.