[SizzleUnrlsd]

Summary

Second item of #68: a finding can be silenced where it stands.

• Acceptance tests first (test: define inline suppressions), implementation follows.
• findings/suppressions.py: # coretrace: ignore on a finding's line suppresses every finding there, # coretrace: ignore[rule, rule] the listed rules only. Python sources are tokenized, so a string that merely contains the marker is not a suppression; other text files (requirements files) are read line by line with the same comment syntax. partition splits findings into kept and suppressed, reading each file once.
• The engine applies it at the end of analyze_file and analyze_project, after the policy, so cached modules and project plugins are covered alike; FileAnalysis.suppressed and ProjectAnalysis.suppressed carry the silenced findings.
• Report.suppressed: the text report ends with no findings, 1 suppressed, the JSON report lists them under suppressed, the SARIF log emits them as results with suppressions: [{"kind": "inSource"}], which is how code scanning services show a dismissed alert. The exit status counts kept findings only.
• Usage guide: a "Suppressing a finding" section.

Part of #68.