[Capability] Add GitLab CI dependency determinism support

[bjcorder]

Summary

Add conservative GitLab CI support for deterministic images and included pipeline references.

Problem

The scanner currently checks GitHub Actions workflows but not GitLab CI. GitLab CI pipelines can drift through mutable container image tags, unpinned services, and project/remote includes that follow branches or tags.

Proposed behavior

• Add gitlab-ci ecosystem support for .gitlab-ci.yml and .gitlab-ci.yaml.
• Add gitlab-ci/image-digest for image, default.image, job-level image, and service image declarations that lack @sha256: digests.
• Add gitlab-ci/include-ref for include entries that reference external projects/remotes without immutable refs where the scanner can safely identify the ref.
• Allow local includes and templates when they do not declare external mutable dependencies.
• Parse YAML structurally and avoid comments, unrelated strings, and templated values the scanner cannot evaluate safely.

Implementation notes

• Reuse existing digest helpers and YAML parsing patterns where possible, but avoid treating every YAML file as GitLab CI.
• GitLab CI image declarations can be scalar or object-shaped; services can be strings or objects with names/aliases. Cover common high-signal forms first.
• For project includes, flag missing or non-SHA ref values when paired with an external project include. For remote includes, define the minimum supported deterministic shape before implementation and document unsupported cases.
• Add docs to README.md, docs/rules.md, docs/ecosystems.md, configuration docs, and the JSON Schema if ecosystem options are added.

Acceptance criteria

• Default discovery includes .gitlab-ci.yml and .gitlab-ci.yaml.
• Missing-digest GitLab CI image and service declarations produce gitlab-ci/image-digest findings.
• Deterministic image references with @sha256: produce no finding.
• External project includes with mutable refs produce gitlab-ci/include-ref findings.
• Local includes, templates, comments, unrelated YAML strings, and unsupported templated values avoid false positives.
• Fixture coverage includes failing and deterministic pass cases under __tests__/fixtures/gitlab-ci/.
• npm run format, npm run all, npm run bundle, and git diff --check pass.

Out of scope

• CircleCI, Azure Pipelines, Jenkins, Buildkite, or other CI systems.
• Resolving GitLab refs over the network.
• Automatically rewriting pipeline files.