fix(scan): reject colliding output paths

[wanggiya]

Closes #ISSUE_NUMBER

Rejects configurations where JSON_FILE and SARIF_FILE resolve to the same output path, preventing the JSON scan from overwriting the SARIF report.

Tested:

• identical paths exit 2
• equivalent relative paths exit 2
• distinct paths pass collision validation
• bash syntax validation passes