[SizzleUnrlsd]

Replaces #252, which replaced the test context with vendored. Stacked on the test-context PR (#244): merge after it.

Summary

• Findings in vendored code, under a third_party, third-party, vendor or vendored directory, carry origin: vendored. It is a separate fact from context (test, example, findings: test code is recognised only by hardcoded-credential #244).
• A vendored project's tests carry both context: test and origin: vendored, so readers and refiners still see why they are test code.
• Both facts are exported in the JSON report and as SARIF result properties. origin was chosen because "provenance" already names where the tool's components come from.
• Nothing is excluded: vendored code is still analysed and reported, and flows through vendored modules are kept. No verdict changes.
• external is left out on purpose: projects often name their own code that way.

Verification

• tests/test_vendored_context.py, new: 12 tests, covering:
  • the classification, origin and context told apart;
  • vendored test code, vendored code and own code;
  • a flow through a vendored module;
  • SARIF with both properties;
  • a refiner that recognises vendored test code (the review case).
• Full suite green, apart from the local test_packaging metadata issue. ruff check and mypy clean. Regression snapshots unchanged.
• Merging the dynamic-import, test-context and this PR into main in that order was simulated without conflict.

Closes #243