feat(supply-chain): add secure install control plane

[duriantaco]

Summary

• Add ca9 protect, a CI security control plane with table, JSON, Markdown, and SARIF output.
• Extend Python install preflight checks to handle requirements files, nested includes, constraints, index selection, and gateway enforcement.
• Add scoped, expiring package policy exceptions across analyzers and npm/pypi runtime gateways.
• Expose the protection workflow through the gh actions.

Why

Maintainers currently need to combine multiple commands and policy mechanisms to secure dependency installation. Real world pip workflows using requirements and constraint files were also difficult to enforce consistently.

This change provides one deterministic command for local and CI enforcement, supports common Python installation
workflows, and replaces broad permanent allowlists.

Tests

• pytest .