feat(aegis-core): Layer 2 Go import alias resolution (PR #17)

[wei9072]

Summary

Closes the last gap from PR #10's Go SEC010 dispatch. Previously
`import myrand "math/rand"` parsed as a single import with module
`"math/rand"` and no alias; `resolve_receiver("myrand")`
missed because the last-segment of "math/rand" is "rand", not
"myrand". SEC010 then silently passed `myrand.Intn(...)` even
though it's the same weak RNG.

Two changes

1. `Import.alias: Option` — new field on the
   `Import` struct in `ast::imports`. Populated when the
   captured path's parent `import_spec` node has a `name`
   field (Go's import-renaming syntax). Filters out `_` (blank
   import) and `.` (dot import) since neither is a usable
   receiver name.
2. `ParsedFile::resolve_receiver` two-pass lookup:
   • Pass 1: explicit alias match. Aliased imports always win.
   • Pass 2: last-segment / module-name match, but skips
     aliased imports — so `rand` no longer falsely resolves
     to a `math/rand` imported as `myrand`.

Tests

• 5 new in `ast::imports` and `ast::parsed_file`:
  Go aliased / unaliased / blank+dot / alias-preferred /
  mixed-aliased-and-unaliased in same file
• 2 new end-to-end SEC010 cases:
  `myrand.Intn` (aliased math/rand) → fires
  `crand.Read` (aliased crypto/rand) → does NOT fire

`cargo test --workspace`: 174 / 174 (was 167).

Test plan

• All Layer 1 alias tests pass
• SEC010 multi-language tests still pass (Go matcher behaviour
  preserved for non-aliased case)
• PR fix(security): SEC010 reads function name + walks past inner blocks #11 / feat(security): SEC009 language-aware dispatch (PR #12) #12 enclosing-context tests still pass
• No FP introduced — checked aliased crypto/rand stays silent
• CI green on push

🤖 Generated with Claude Code