feat(scan): attach the developer's SSH keys for private module fetches

[liamcervante]

Prepares the CLI for the parser's move to an in-process getter (grabber). grabber's SSH system fallback only consults the ssh-agent, so a developer whose key lives in ~/.ssh but isn't loaded into an agent would lose access to private git-over-ssh modules. This reads those on-disk keys and passes them explicitly as FetchAuth on GenericOptions.

SSH keys are the only thing the CLI needs to set — HTTPS credentials (keychain / store / netrc via git credential fill), ~/.ssh/known_hosts verification, and the agent are all still covered by grabber's system fallback on a dev machine.

Changes

• internal/scanner.ResolveSSHFetchAuth builds FetchAuth.ssh_keys from either an explicit list (--ssh-key-file / INFRACOST_CLI_SSH_KEY_FILE, comma-separated) or, when unset, the standard ~/.ssh default key files (id_rsa, id_ecdsa, id_ed25519, …). Passphrase-protected and unreadable keys are skipped with a warning/debug log — they remain resolvable via the agent.
• Keys travel with an empty host (offered as defaults for any host). Combined with grabber's key→agent fallback this never suppresses the agent: the on-disk key is tried first, the agent is the fallback.
• Wired on every fetch-capable command — scan, price, policies — and the MCP scan/price tools (via cfg). The --ssh-key-file flag is registered on scan and price (mirroring --currency); the env var flows to all of them through cfg.

Notes

• Requires the proto FetchAuth options — pinned to the proto branch commit here; repin to the tag once feat(options): add FetchAuth and GIT_HTTP credentials for remote fetching proto#88 merges.
• The parser side that consumes FetchAuth.ssh_keys lands with the grabber migration; the field is additive and ignored until then.

Checklist

• Technical docs updated (or not needed)