0.2.3: per-path cloud settings for repositories that mix clouds

[intikhab49]

Closes #1.

A plan can now give parts of a repository their own clouds, so one fairfax scan covers a repository that mixes them:

tenant: gcchigh
azure: government
paths:
  - glob: "services/legacy-billing/**"
    azure: commercial
  - glob: "apps/partner-portal/**"
    tenant: gcc

$ fairfax scan . --plan plan.yaml
fairfax scan: tenant GCC High, Azure Government, 2 path overrides from the plan

app/settings.py
  1:18  kv-main.vault.azure.net  ->  kv-main.vault.usgovcloudapi.net
      Azure Key Vault: Azure Government uses vault.usgovcloudapi.net.

apps/partner-portal/config.py  (checked as tenant GCC, Azure Government, from paths: apps/partner-portal/**)
  1:22  partners.crm4.dynamics.com  ->  partners.crm9.dynamics.com
      Dataverse environment URL: a GCC tenant uses crm9.dynamics.com.

services/legacy-billing/client.py  (checked as tenant GCC High, commercial Azure, from paths: services/legacy-billing/**)
  2:18  graph.microsoft.com  ->  graph.microsoft.us
      Microsoft Graph: a GCC High tenant uses graph.microsoft.us.

3 wrong-cloud endpoints and 0 to check in 3 of 4 files scanned.

The billing service's commercial Key Vault host passes because that path is on commercial Azure, while its Graph host is still flagged because the tenant there is still GCC High.

Rules

• Globs are relative to the plan file's folder, so a path gets the same clouds however fairfax scan is run. * also matches / (as in --exclude), and a path without wildcards covers that file or that whole folder.
• When several globs match a file, the one that spells out more of the path wins, separately for tenant and azure; on a tie the later entry wins. So a nested entry that sets only tenant keeps the azure of the folder around it.
• --tenant and --azure replace the plan's top-level clouds, and paths: still applies on top. fairfax check uses only the top-level clouds.
• A bad entry is an error (exit 2): a missing glob, an unknown key, an entry that sets neither cloud, or an unknown tenant or cloud.

Output

• Text and Markdown: a file whose clouds came from paths: says which ones and which globs set them. Files on the plan's own clouds look exactly as before, so the README examples are unchanged.
• JSON: every hit has tenant, azure and from_paths, and the top level lists the plan's paths.
• SARIF: every result has tenant, azure and fromPaths properties, and the message notes an override.
• The GitHub Action already passes --plan to the scan, so overrides work there with no new input.

Also: version 0.2.3; the README and site Action snippets say @v0.2.3; a new site FAQ entry, "Can one repository mix GCC, GCC High and commercial clouds?", which also lands in the FAQ markup and llms.txt.

Tested: 69 tests pass, 15 of them new: plan validation, specificity and ties, folder paths, a mixed repository end to end, globs relative to the plan file, files outside it, flag precedence, and all four output formats. actionlint is clean.

After merge: publish release v0.2.3 (PyPI, then the Marketplace listing follows the release). Until then the site's Action snippet names a tag that doesn't exist yet, so the release should follow the merge.