feat(parser): add Erlang/OTP parser for app.src, rebar.config, rebar.lock

[mstykow]

Summary

• Add and harden the Erlang / OTP parser family for *.app.src, rebar.config, and rebar.lock, including map-aware metadata handling, alias-aware Rebar package identity, and bounded %PLACEHOLDER% template parsing for canonical OTP manifests such as diameter.app.src
• Verify scorecard row 44 end to end with compare-outputs against processone/ejabberd, erlang/otp, and vernemq/vernemq, then record benchmark rows and mark the row 🟢 Verified
• Refresh the generated parser-planning and supported-format docs so the shipped Erlang / OTP support is reflected in repo documentation
• Keep weak bare-word GPL shorthand as clue-only evidence while confirming that stronger GPL and GPL-with-exception findings in the OTP compare lane still remain hard detections

Issues

• Covers: Support parsing: Erlang and OTP manifest files #355

Scope and exclusions

• Included:
  • *.app.src parsing for OTP application metadata, stdlib-filtered dependencies, runtime dependency extraction, and template-placeholder resilience
  • rebar.config parsing for Hex, git, alias, and profile-scoped dependencies
  • rebar.lock parsing for resolved package identity, git refs, and hash coverage
  • sibling merge coverage for rebar.config + rebar.lock
  • generated docs updates in docs/SUPPORTED_FORMATS.md, docs/implementation-plans/package-detection/PARSER_PLAN.md, docs/BENCHMARKS.md, and docs/benchmarks/scan-duration-vs-files.svg
  • compare-output verification runs for:
    • .provenant/compare-runs/20260422T183347Z-ejabberd-26578
    • .provenant/compare-runs/20260422T182619Z-otp-15523
    • .provenant/compare-runs/20260422T182920Z-vernemq-20484
• Explicit exclusions:
  • no Erlang expression evaluation, variable expansion, or plugin execution
  • conditional dependency wrappers like {if_var_true, ...} stay skipped instead of being guessed at

Intentional differences from Python

• This remains a net-new Provenant parser family with no Python ScanCode package-parser reference implementation for Erlang / OTP
• Weak bare-word GPL shorthand such as the clue-only gpl_bare_word_only.RULE stays demoted to clue evidence; OTP triage confirmed that stronger GPL and GPL-with-exception findings still surface as detections rather than being demoted with it

Follow-up work

• Created or intentionally deferred:
  • none

Expected-output fixture changes

• Files changed: testdata/erlang-otp-golden/*.expected, testdata/assembly-golden/erlang-otp-basic/expected.json
• Why the new expected output is correct:
  • the parser and assembly expectations were generated from current Rust output for representative Erlang fixtures, and rerunning the Erlang parser goldens plus scan/assembly contract tests after the %PLACEHOLDER% parser fix required no further golden updates