Add Elixir Mix ecosystem support

[bjcorder]

Problem

The scanner does not currently inspect Elixir Mix projects. Mix dependencies can drift through non-exact Hex requirements, missing mix.lock, and git dependencies pinned to branches/tags instead of immutable refs.

Proposed behavior

Add conservative static Mix support.

Suggested rule shape:

• Ecosystem: elixir or mix.
• Include mix.exs and use mix.lock as the companion lockfile.
• Parse common deps tuple shapes well enough to identify Hex dependencies, git dependencies, path dependencies, and options such as branch, tag, and ref.
• Report missing mix.lock when dependencies exist and lockfile policy is enabled.
• Flag non-exact Hex requirements and git dependencies without full commit SHA refs.
• Allow path dependencies and full-SHA ref pins.
• Avoid findings in comments and unrelated strings where practical.

Acceptance criteria

• Default discovery includes mix.exs.
• The scanner reports missing mix.lock, floating Hex dependency requirements, and branch/tag git dependencies.
• The scanner does not report exact/pinned dependencies, full-SHA git refs, path dependencies, or comments/unrelated strings.
• Fixture coverage is added under __tests__/fixtures/elixir/ or __tests__/fixtures/mix/.
• Rule docs, ecosystem docs, README supported ecosystems, configuration docs, and schema are updated as needed.
• If runtime behavior changes, run npm run bundle and commit the updated dist/ output.