[SizzleUnrlsd]

Summary

The last point of #37, done the way Hugo chose: the analysis stays offline and deterministic, advisories come from a local file imported once from a public dump.

• Acceptance tests first (test: define local advisory feeds and dependency policies), implementation follows.
• dependency/advisories.py: read_osv walks a JSON file, a directory of them or a zip archive; import_osv keeps the PyPI records and turns each range of events (introduced, fixed, last_affected) into a version specifier, with the summary, the GHSA/CVE aliases and the severity from database_specific; dump_advisories / load_advisories read and write a small versioned advisories.json. OSV names no affected APIs, so imported advisories feed the requirement checks and the SBOM; a local entry completed with affected_symbols feeds reachability and correlation too.
• Engine: a directory check reads advisories.json at the root and the files passed with --advisories, merges them with plugin advisories by identifier, package and range, the local file winning; workers reload the same files. Unreadable files become syntax-error notes, like dependency files.
• dependency/policy.py and the shipped dependency-policy project plugin: coretrace-policy.toml at the root or --policy FILE denies packages (denied-dependency, high), requires pins (unpinned-dependency, low) and lists accepted advisories, whose findings are dropped whatever produced them. ProjectContext exposes the policy.
• CLI: --import-advisories SRC OUT converts a dump and exits; the positional path is optional for that action only.

Closes #37