Collapse severity and delta chips behind an expandable detail area

[LarsLaskowski]

Summary

Adds an opt-in compact severity row and moves the full breakdown plus the scan deltas into an expandable detail area on the vulnerability assessment card.

• VulnerabilitySeverityChips gains a Compact parameter (default false). In compact mode it keeps the critical and high chips and folds medium, low and unknown into a single neutral +N more chip, which is omitted when nothing is folded away.
• VulnerabilityAssessmentCard leads with the compact row and offers a "Show details" toggle backed by a MudCollapse that holds the full severity row and the delta chips. The expander state is component-local.
• The delta chips now name the comparison: +N since last scan and −N fixed since last scan (U+2212 minus sign).
• RuntimeContainers, MyImages, ObservedImages and SharedBaseImages switch to Compact="true"; the dashboard tiles and the base-image chain rows on the three detail pages keep the full breakdown.

Why

A single image can produce 20 Critical · 96 High · 365 Medium · 682 Low · 73 Unknown followed by +1236 new and −1236 resolved — seven chips, most of them four-digit, on a card whose actual message is that nothing is fixable. On a 390 px viewport that row wraps into a wall, and the medium/low/unknown buckets are rarely what the decision is made on. Nothing is removed; every number stays one interaction away.

Linked issues

Closes #209

Review notes

• The eight existing call sites and VulnerabilitySeverityChipsTests are unaffected because Compact defaults to false.
• The toggle only appears when the compact row actually folds something away or the last scan reported a delta, so a card with only critical and high findings and no deltas shows no expander.
• The delta chips still rely on the first-scan suppression from [BUG] Vulnerability new/resolved deltas are wrong — anchor them to scan runs instead of a time window #203: that logic already zeroes both counts for a first scan, so the existing > 0 guard is what keeps them off a first-scan card.
• aria-expanded is bound through a string property rather than the bool field, because Blazor drops a bool attribute value of false from the markup entirely.
• Compact mode with zero critical and zero high findings renders the counter chip alone. VulnerabilitySeveritySummaryViewData.HighestSeverity remains available if a named single-chip fallback is wanted there later.
• Not verified in a running browser at 390 / 768 / 1280 px — no app instance with a database was available in this environment. The change reduces the row from up to five severity chips plus two delta chips down to at most three chips, which is what the wrapping problem was about, but the visual check against docs/ui-concept/README.md is still worth doing.

Follow-up work

None

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.2% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud