Add dependency and secret analysis plugins #37

The plugin system is not limited to the PyIR pipeline.

• Dependency resolver for requirements.txt, pyproject.toml, poetry.lock, uv.lock producing a dependency graph (feat: dependency analysis and reachable vulnerabilities #38)
• OSV, GHSA and policy plugins on top of the dependency graph (feat: dependency analysis and reachable vulnerabilities #38 advisory records and vulnerable-dependency; feat: local advisory feeds and policies #47 offline OSV/GHSA import into a local advisories.json, --advisories files, coretrace-policy.toml with dependency-policy plugin; the analysis stays offline by decision)
• Reachability plugin: vulnerable package + affected API + CallGraph = reachable vulnerability (feat: dependency analysis and reachable vulnerabilities #38)
• Secret plugins: generic entropy and provider-specific patterns (feat: secret detection and SBOM #46: SecretDetector base over PyHIR string literals, shipped hardcoded-secrets plugin with provider formats, credential names and entropy, one redacted finding per literal)
• SBOM generation (feat: secret detection and SBOM #46: dependency/sbom.py, CycloneDX 1.5 with package URLs and affecting advisories, --sbom PATH)

Reference: docs/architecture.md §26 Dependency Plugins, §25 plugins/dependency and plugins/secrets.

Delivery: #38 (dependency graph, advisories, project plugins, two detectors)
Delivery: #46 (secrets, SBOM)
Delivery: #47 (advisory feeds, policies)