feat(html-reporter): show duplicate package versions in HTML report

[ELHart05]

Summary

When the same vulnerable package is installed at more than one version, the findings table lists each install on its own row and nothing ties them together. This adds a "Duplicate package versions" card above the findings table so you can see, in one place, which vulnerable packages exist at multiple versions and where each version comes from.

Why this change

Issue #235: the report had no consolidated view of a vulnerable package that appears at several versions across the tree. That is exactly the case where a single upgrade or an override can collapse several findings at once, but today you have to spot it by scanning the table yourself.

What changed

• Add a "Duplicate package versions" card, rendered above the findings table. It groups the vulnerable findings by package name, keeps the ones present at two or more distinct versions, and lists each version with its severity and its origin (a direct dependency, or the parent it is pulled in through).
• Sort the most-duplicated packages first for a stable, useful order.
• The card is derived at render time from the findings already in the report, so there is no change to the scan or to the shape of report.json.
• The section is omitted entirely when no package is installed at multiple versions.
• Reuses the existing card and severity-badge styling, so it inherits the report's light/dark theming and needs no new client-side JS.

Validation

• npm run build (strict tsc) passes.
• The reporter suite passes, including 5 new tests: grouping, same-version-not-duplicated, rendering with the version count and origin, HTML-escaping, and empty-case omission. The test-hygiene pretest gate passes.
• Eyeballed the rendered fragment on a mixed sample (a three-version and a two-version package plus a single-version one) to confirm ordering, origins, and escaping.

User-facing impact

Does this change:

• affect scanning behavior
• affect output formatting
• affect JSON output
• affect docs only

Notes

The consolidation is a view over existing finding data, so it does not add a field to report.json; the raw per-version findings are already there. If you would rather also expose a computed duplicates array in report.json for tooling, I am happy to add that as a follow-up.

Closes #235