Feat/cipherscope scan test

[script3r]

Require import+API; remove confidence/flags; add gating tests; docs + clippy + fmt

Why

• Reduce false positives and simplify configuration.
• Make detection semantics explicit and testable.

Changes

• Require both an anchor (import/include/namespace) and at least one API match for libraries that define anchors.
• Remove confidence from findings and delete all related logic.
• Drop CLI/config flags: --min-confidence, --fail-on-find, --allow, --deny.
• Clean up comments and references to deprecated behavior.

Tests

• Add anchors test (Google Tink/Java): import-only → no hit; API-only → no hit; import+API → hit.
• Add filtering tests:
  • Commented import suppression for Java JCA/JCE.
  • PHP OpenSSL API-only detection still works (no anchors).
  • include_glob correctly filters languages.
  • max_file_size skips large files.

Docs

• Update README and static demo JSON (confidence removed; flags removed).

Quality

• cargo test --workspace: passing.
• cargo clippy --workspace --all-targets -- -D warnings: clean.
• cargo fmt --all -- --check: clean.

Breaking changes

• Output schema change: confidence field removed.
• CLI flags removed: --min-confidence, --fail-on-find, --allow, --deny.