Add Kubernetes and Helm manifest support

[bjcorder]

Problem

The current container ecosystem checks Dockerfiles, Docker Compose, and devcontainer image references, but it does not inspect Kubernetes manifests or Helm charts. Many deployed images are declared only in Kubernetes YAML, Helm values.yaml, or Chart.yaml dependencies, so image tags and chart dependencies can still drift outside the current scanner surface.

Proposed behavior

Add conservative Kubernetes/Helm support focused on high-signal deterministic checks.

Suggested rule shape:

• Ecosystem: kubernetes and/or helm, or extend containers for image digest findings while adding Helm-specific rules.
• Include common manifest files only if the pattern can avoid scanning every YAML file in large repositories, or document recommended include patterns for this ecosystem.
• Detect container image fields in Kubernetes objects such as containers[].image, initContainers[].image, and ephemeralContainers[].image.
• Flag Kubernetes image references without @sha256: digests, following the existing container image severity model.
• For Helm charts, consider Chart.yaml dependencies plus Chart.lock coverage and repository/version constraints.
• Be careful with Helm templates and values files; avoid broad string matching that creates noisy findings in examples, docs, or placeholders.

Acceptance criteria

• The implementation has a clear discovery strategy for Kubernetes/Helm files that does not unexpectedly scan every YAML file by default without docs and tests.
• Kubernetes container image fields are parsed structurally and report missing digests.
• Helm chart dependency lockfile behavior is documented if implemented; otherwise image-only Helm support is clearly scoped.
• The scanner avoids comments, unrelated YAML strings, examples, and templated values it cannot safely evaluate.
• Fixture coverage is added under __tests__/fixtures/kubernetes/ and/or __tests__/fixtures/helm/.
• Rule docs, ecosystem docs, README supported ecosystems, configuration docs, and schema are updated as needed.
• If runtime behavior changes, run npm run bundle and commit the updated dist/ output.