[Security/Efficiency] Add scanner resource limits and skipped-file diagnostics

[bjcorder]

Summary

Add configurable scan resource limits and deterministic skipped-file diagnostics to avoid unbounded parsing in very large or adversarial repositories.

Problem

The scanner discovers matched dependency files and parses file contents plus companion lockfiles without explicit size/count guardrails. Large generated manifests or lockfiles can make scans slow, memory-heavy, or noisy. Today skipped-file behavior is mostly implicit through include/exclude patterns.

Proposed behavior

• Add config/action inputs:
  • max-files: maximum number of discovered files to evaluate after include/exclude filtering.
  • max-file-size-bytes: maximum size for primary scanned files.
  • max-companion-file-size-bytes: maximum size for companion lock/metadata files read during rule evaluation.
• When limits skip files, emit deterministic diagnostics/warnings rather than policy findings.
• Add a skipped-count output.
• Add a skipped-files section to the Markdown report and GitHub job summary.
• Avoid false lockfile findings when a companion lockfile exists but is too large to parse; surface that as a skipped/limited companion diagnostic instead.

Implementation notes

• Add internal types such as ScanDiagnostic and SkippedFile to carry skip reason, file, size/count, and configured limit.
• Enforce limits after deterministic file sorting so skip behavior is stable.
• Keep defaults permissive enough to preserve current behavior for normal repositories.
• Config validation should warn and fall back for invalid non-negative integer inputs.
• Consider whether diagnostics should be included in SARIF. If included, keep them separate from rule findings and document the behavior.

Acceptance criteria

• Tiny test limits produce deterministic skipped-file warnings and skipped-count output.
• Markdown report and job summary include skipped-file information.
• Companion lockfile size-limit tests do not produce misleading missing-lockfile findings when the oversized lockfile exists.
• Invalid limit inputs warn and fall back deterministically.
• Existing default scans are behavior-compatible when limits are unset.
• Docs and JSON Schema include the new fields.
• npm run format, npm run all, npm run bundle, and git diff --check pass.