Improve scanner reliability and built-in rule handlin

[nobuo-miura]

Summary

Improve SecretLens reliability across rule loading, Docker images, CI logs, live verification, exclusions, baselines, and output handling.

Problems

• Built-in rules were unavailable when the binary was installed with go install.
• Docker layer parsing could silently miss secrets or ignore errors.
• GitHub Actions logs were fetched through an incorrect API endpoint.
• Live verification used masked values and inferred providers from rule IDs.
• Glob exclusions such as **/testdata/** did not work consistently.
• Git and environment-file results could be duplicated.
• Text output did not respect --out.
• Invalid flag values were silently accepted.
• Baseline updates were not implemented.
• Organization scans used shallow clones and exposed tokens through clone URLs.

Changes

• Embed built-in YAML rules in the binary.
• Support additional and overriding rules through --rules-dir.
• Stream Docker layers and propagate parsing errors.
• Support legacy and OCI image layouts.
• Use the repository workflow-runs API for GitHub Actions logs.
• Restrict live verification to explicitly configured providers.
• Remove unsupported GCP API-key verification.
• Clear raw secret values before reporting.
• Add proper ** glob support.
• Deduplicate findings and stabilize fingerprints across line changes.
• Implement baseline updates.
• Validate source, format, severity, and custom-rule definitions.
• Respect --out for text reports.
• Use full-history organization clones without placing tokens in URLs.
• Add tests for Docker parsing, glob exclusions, and rule validation.