feat(severity): reduce false positives for lateral refactors within pattern families

[lachaib]

Summary

When a dependency upgrade refactors code to use a semantically equivalent API (e.g. replacing __import__() with importlib.import_module()), lockscan previously flagged the new hits at full severity without considering that the old pattern's count dropped. This produced HIGH findings for what is effectively a code quality improvement with no net increase in attack surface.

This PR introduces two improvements:

• Pattern family grouping with net-delta severity (severity.ts): Labels that represent the same underlying capability are grouped into families (dynamic-import, eval, shell, deser). When a delta hit belongs to a family, the effective severity is only escalated if the family's net hit count grew meaningfully — beyond max(3, 20% of old count). A marginal net increase (as seen when exec:__import__ drops while exec:importlib rises by roughly the same amount) is treated as a lateral refactor and downgraded to low. critical patterns are never downgraded.

• Per-label old→new breakdown in the text report (report.ts): The SECURITY SCAN section now opens with a by pattern (old → new, net): table showing count changes across all labels, making substitution patterns immediately legible without manually diffing the old/new hit lists.

Motivation

A pytest 9.0.3 → 9.1.0 upgrade was triggering a HIGH finding due to 6 new exec:importlib hits introduced by an internal refactor that simultaneously reduced exec:__import__ from 8 to 3 hits. The family net delta was +1 — well below the threshold — so with this change it correctly resolves to LOW.

Test plan

• Run lockscan against a lockfile diff that bumps pytest from 9.0.3 to 9.1.0 — overall severity should drop from HIGH to LOW
• Run lockscan against a package that genuinely adds new shell execution — severity should remain MODERATE/HIGH (family net increase exceeds threshold)
• pnpm tsc --noEmit passes

🤖 Generated with Claude Code