feat(sourcehunt): respect gitignore during scans

[shibukazu]

Summary

• Add a new --respect-gitignore flag for clearwing sourcehunt.
• Exclude files and directories matched by the target repository's root .gitignore during source enumeration and static analysis.
• Thread the option through the preprocessor, imports-by heuristic, and Semgrep sidecar.
• Document the flag and add regression tests for ignored generated output.

Motivation

Generated artifacts such as Next.js .next/ output can produce noisy sourcehunt findings when they are ignored by the project but still scanned by Clearwing. This opt-in flag lets users keep the current scan-everything behavior by default while avoiding ignored build outputs when desired.

Testing

• uv run pytest tests/test_analysis.py tests/test_sourcehunt_preprocessor.py tests/test_sourcehunt_semgrep.py
• uv run ruff check clearwing/analysis/source_analyzer.py clearwing/sourcehunt/preprocessor.py clearwing/sourcehunt/semgrep_sidecar.py tests/test_analysis.py tests/test_sourcehunt_preprocessor.py

Notes

• The flag currently reads the repository root .gitignore.
• Existing behavior is unchanged unless --respect-gitignore is passed.