Rewrite Dockerfile optimizer for v1

[davidgrldo]

What changed

• replace raw-line substring scanning with a dependency-free internal Dockerfile parser
• add typed stages, source ranges, stack detection, stable rule IDs, and corrected Go/PHP/.NET/Java/Rust/Ruby rules
• introduce the breaking JSON schema v1 and explicit human/error reporters
• add --fail-on with stable 0/1/2 exit semantics for CI
• remove pflag and the legacy parser package
• add parser, analyzer, reporter, CLI, race, fuzz, and fixture regression coverage
• replace the broken workflow with SHA-pinned source and fixture verification
• add Dependabot, MIT license, changelog, and accurate v1 documentation

Why

The previous implementation treated Dockerfiles as raw strings. Comments, instruction casing, continuations, heredocs, and multi-stage builds could therefore create false positives or hide real findings. Severity was presentation-only, JSON output was incidental, and the repository workflow analyzed a root Dockerfile that did not exist.

This change gives parsing, analysis, reporting, and CI explicit contracts suitable for a v1 release.

Impact

• JSON field names and structure are intentionally breaking and carry schema_version: "1".
• findings meeting --fail-on return exit 1; operational and parse failures return 2.
• Python, Node, and C/C++ are detected but clearly reported as generic-check-only.
• the binary now has no third-party runtime dependencies.

Validation

• gofmt clean
• go vet ./...
• go test ./... -count=1
• go test -race ./... -count=1
• parser fuzzing for 3 seconds
• go build ./cmd/dockopt
• CLI fixture exits: clean 0, finding 1, malformed/unterminated 2
• module, action-pin, legacy-reference, and diff checks
• task-level reviews for all seven implementation tasks
• final whole-branch review: ready to merge, no Critical or Important findings

Follow-up

• A narrow non-blocking heuristic edge remains when Composer flags are immediately followed by shell punctuation such as --no-dev;.