Build the correlation engine #39

A global engine correlates multiple results into one high-confidence finding.

• Correlate vulnerable dependency + affected API + reachable call + attacker-controlled value reaching it (feat: correlation engine #40: ADVISORY taint kind, dependency/correlation.py)
• Output feeds the Vulnerability / Hotspot / Refuted classification and the reporters (feat: correlation engine #40: refuted flows dropped, hotspots at medium confidence, findings rendered like any other)

Reference: docs/architecture.md §27 Correlation Engine.

Delivery: #40