Add verification policy rules

[CoderSufiyan]

Summary

• add verification policy support for npm packages and GitHub repositories
• allow approved package names, publishers, repositories, and hosts with wildcard patterns
• require pinned commit SHAs for GitHub targets
• block install scripts and findings at configured severities
• support suppression entries with rule IDs, locations, reasons, and ISO expiry dates
• report policy violations separately from scanner findings
• integrate with the versioned verification report model
• CLI --policy <file> option with exit code 4 on policy failure

Verification

• bun run test (54 tests)
• bun run build
• live CLI policy test against mcp-risk@0.4.0 and esbuild@0.25.0

Closes #29