feat: add gitignore filtering that respects git-tracked files

[danskmt]

Description

Adds GetRulesBySource/GetFilteredFilesBySource to pkg/utils.FileFilter (CLI-1411): a file tracked in git that matches a .gitignore rule is no longer silently excluded from scans, since git itself only ignores untracked files. .snyk/.dcignore exclusions and the default .git rule still always exclude, tracked or not.

Existing callers see zero behavior change until they opt in by switching to the new by-source methods. The new FF_GITIGNORE_RESPECT_TRACKED_FILES flag constant is added for consumers to gate that switch; no consumer wiring is included in this PR.

Tracked-file lookup reads the git index via go-git (already a dependency), bounded to the intersection of tracked ∩ gitignore-matched files, and fails open (falls back to today's exclusion behavior) if the scan path isn't a git repository or the index can't be read — logged at debug, since not being a git repo is the common case. A genuinely broken repo (exists but can't be opened/read) logs at warn instead. When any file is rescued, a warn-level log also surfaces the specific files, since that's a real change in what gets scanned.

Checklist

• Tests added and all succeed (make test)
• Regenerated mocks, etc. (make generate)
• Linted (make lint)
• Test your changes work for the CLI
  1. Clone / pull the latest CLI main.
  2. Run go get github.com/snyk/go-application-framework@YOUR_LATEST_GAF_COMMIT in the cliv2 directory.
     • Tip: for local testing, you can uncomment the line near the bottom of the CLI's go.mod to point to your local GAF code.
  3. Run go mod tidy in the cliv2 directory.
  4. Run the CLI tests and do any required manual testing.
  5. Open a PR in the CLI repo now with the go.mod and go.sum changes.
  • Once this PR is merged, repeat these steps, but pointing to the latest GAF commit on main and update your CLI PR.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.