feat(diff): compare CodeQL findings across base and head databases

[Darkroom4364]

Problem

The completed CodeQL bridge accepts one prebuilt --codeql-db and normalizes its results into Finding, but foxguard diff has no paired base/head CodeQL inputs. It therefore cannot decide whether a CodeQL data-flow result is newly introduced by a change.

Scope

Extend foxguard diff to accept paired, prebuilt base and head CodeQL databases, execute the configured CodeQL rules against both, normalize both result sets through the existing bridge, and feed them to the existing diff comparison. Preserve existing diff output semantics for introduced findings.

Non-goals

Do not build or download CodeQL databases, bundle CodeQL, add new queries, or change non-CodeQL diff behavior.

Acceptance criteria

• Diff mode requires an unambiguous paired base/head database configuration and reports a clear error for an incomplete pair.
• Equivalent normalized CodeQL findings present in both databases are not reported as new; head-only findings are emitted through the existing diff result path exactly once.
• Missing CodeQL or an analysis failure follows the bridge's explicit failure/skip contract and never produces a false clean delta.
• Tests use controlled CodeQL/SARIF fixtures or a fake CodeQL executable to cover unchanged, introduced, and removed findings without requiring a real database build.