Add Dart and Flutter Pub ecosystem support

[bjcorder]

Problem

The scanner does not currently inspect Dart or Flutter projects. Pub dependencies can drift through broad YAML constraints, missing pubspec.lock, and git dependencies that point at branches or tags instead of immutable revisions.

Proposed behavior

Add conservative static Pub support.

Suggested rule shape:

• Ecosystem: dart or pub.
• Include pubspec.yaml and use pubspec.lock as the companion lockfile.
• Parse common dependencies, dev_dependencies, and dependency_overrides entries.
• Report missing pubspec.lock when dependencies exist and lockfile policy is enabled.
• Flag floating version constraints such as any, broad ranges, caret ranges when not allowed by policy, and git dependencies without full commit SHA refs.
• Allow SDK/path dependencies and exact versions with lockfile coverage where appropriate.
• Avoid findings in comments and unrelated YAML strings.

Acceptance criteria

• Default discovery includes pubspec.yaml.
• The scanner reports missing pubspec.lock and non-deterministic Pub dependency declarations.
• The scanner reports git Pub dependencies that use branch/tag refs instead of full commit SHAs.
• The scanner does not report deterministic exact versions with lockfile coverage, SDK/path dependencies, or comments/unrelated strings.
• Fixture coverage is added under __tests__/fixtures/dart/ or __tests__/fixtures/pub/.
• Rule docs, ecosystem docs, README supported ecosystems, configuration docs, and schema are updated as needed.
• If runtime behavior changes, run npm run bundle and commit the updated dist/ output.