[SizzleUnrlsd]

Stacked on the test-context PR (#244). Merge after it.

Summary

• Files under a third_party, third-party, vendor or vendored directory carry context: vendored, through the classification of findings: test code is recognised only by hardcoded-credential #244.
• vendored comes first: the test code of a vendored project is vendored, and the context replaces the one a rule gave, without changing its confidence.
• Nothing is excluded. Vendored code is still analysed and reported, so a flow from the project through a vendored module is kept.
• external is left out on purpose: projects often name their own code that way.
• SARIF exports the context.

Verification

• tests/test_vendored_context.py, new: 11 tests, covering:

  • the classification;
  • findings kept and marked, with the same confidence as the same code in the project;
  • a flow through a vendored module still reported at the project's call;
  • SARIF.

  No existing test changed.

• Full suite green, apart from the local test_packaging metadata issue. ruff check and mypy clean.

• On a C++ project vendoring GoogleTest, the 7 findings are still reported, all with context: vendored.

Closes #243

[SizzleUnrlsd]

Superseded by the PR from feat/vendored-origin: the review asked to keep the vendored origin apart from the test context, which reworks this branch beyond a follow-up commit.