scanner: package-level composite literal (var x = &Type{...}) is not detected

[flaglint]

A composite literal directly initializing a package-level var, never inside any function body, is not detected.

var svcClient, _ = ld.MakeClient("k", 5)
var svc = &Svc{Client: svcClient}

func NewUI(userID string) bool {
	v, _ := svc.Client.BoolVariation("new-ui", ldcontext.New(userID), false)
	return v
}

runWholeScanAnalysis's Pass B (composite-literal field binding) only ever walked function scopes (collectFuncScopes/walkScoped) — a literal directly initializing a package-level var was never visited at all, regardless of resolveAssignedBinding/compositeLiteralFieldBindings themselves being perfectly capable of resolving it if only they were given the chance to see it.

Root-caused during issue #18's Pass B fixed-point fix but never filed as its own issue at the time.

Found via direct testing against flaglint/corpus's composite-literal-binding fixture (an external adversarial test corpus shared with flaglint-js).

[flaglint]

Fixed by #34 (merged) — closing manually since GitHub's auto-close only picked up the first issue reference in the PR description.