Add Swift Package Manager ecosystem support

[bjcorder]

Problem

The scanner does not currently inspect Swift Package Manager projects. Swift packages can drift when Package.swift uses branch-based requirements, open ranges, or revisions that are not immutable, and application repositories typically rely on Package.resolved for deterministic resolution.

Proposed behavior

Add conservative static SwiftPM support.

Suggested rule shape:

• Ecosystem: swift or swiftpm.
• Include Package.swift and use Package.resolved as the companion lock/resolution file.
• Flag branch-based dependencies such as .branch(main) and open version ranges such as .upToNextMajor or .upToNextMinor unless lockfile policy explicitly allows them.
• Allow exact version requirements such as .exact(1.2.3) and immutable revision requirements when the revision is a full commit SHA.
• Require Package.resolved for package dependencies by default for application/workspace determinism, subject to an ecosystem option.
• Avoid findings in comments and unrelated Swift strings where practical.

Acceptance criteria

• Default discovery includes Package.swift.
• The scanner reports branch/floating SwiftPM dependency requirements and missing Package.resolved when policy requires it.
• The scanner does not report exact versions, full-SHA revision pins, or comments/unrelated strings.
• Fixture coverage is added under __tests__/fixtures/swift/ or __tests__/fixtures/swiftpm/.
• Rule docs, ecosystem docs, README supported ecosystems, configuration docs, and schema are updated as needed.
• If runtime behavior changes, run npm run bundle and commit the updated dist/ output.