Pass policy-id as a CLI argument, not an option flag

[gvauter]

Is your feature request related to a problem? Please describe.

Currently the generate and scan commands expect the target policy ID to be passed via the --policy-id CLI flag. However, given policy ID is a required argument (vs an optional flag) for these commands, a more canonical pattern would be to accept the policy ID as a positional argument. In addition, this reduces typing required for the common generate -> scan workflow.

complyctl scan --policy-id cis-fedora-server

Describe the solution you'd like

Policy ID should be passed as a CLI argument, not a flag.

complyctl scan cis-fedora-server

Describe alternatives you've considered
Leave as is today.

Additional context

A few industry precedents:

Tool	Pattern	Example
kubectl	Positional	kubectl get pods my-pod
docker	Positional	docker run nginx
git	Positional	git checkout main

[hbraswelrh]

Collect feedback on flag preferences
Meeting suggestions:

• Create a poll
• Keep flag
• Positional argument
• "Scan this target" vs "Scan this policy"

[hbraswelrh]

@gvauter assigning to you! From the community meeting it was suggested to create a spec and share it with the ComplyTime Community for discussion and agreement 👍

[gvauter]

Summary from community meeting:

• Keep --profile-id flag, do not switch to positional arg
• Implement complyctl scan <target> [--policy-id policy] and/or --target-id flag to scope scan to target, not policy (or support passing both flags to scope scan execution)
• Default behavior could just look at complytime.yaml scan, but this could require multiple "scan" runs if incompatible profile and target combos
• passing --profile-id is somewhat of a leaky abstraction from the openscap-plugin due to SCAP needing profile to generate tailoring file