Add --exclude glob flag to skill scan

[serval-frenchie]

Summary

• Adds a repeatable --exclude PATTERN option to skillspector scan
• Patterns are applied during file discovery in build_context, so excluded files are absent from both the Components table and any analyzer findings
• Uses fnmatch semantics against the path relative to the scan root

Problem

SkillSpector's static analyzers read every file with utf-8 + errors='replace' and run regex patterns against the result. When a skill bundle ships binary assets (PDFs, images), raw bytes can incidentally match patterns like shell=True, -rf /, or --no-verify, producing HIGH-severity false positives. There is currently no way to suppress these short of moving the file out of the skill folder, which is a non-starter for adoption in CI: every push surfaces a HIGH finding that has to be dismissed manually in the GitHub Security tab.

Solution

skillspector scan ./my-skill/ --exclude '*.pdf' --exclude 'assets/*'

• Repeatable flag (List[str] via Typer), threaded into graph state as exclude_patterns
• Filtering happens once, in _walk_skill_files, before components, file_cache, and component_metadata are built — so the rest of the pipeline is unchanged
• Each exclusion is logged at DEBUG (visible with --verbose)
• Excluding everything is valid: the scan succeeds with no findings

Tests

• tests/nodes/test_build_context.py: exclusion filters components/file_cache/metadata, directory glob patterns, no-match leaves the list intact, exclude-everything yields empty state
• tests/unit/test_cli.py: end-to-end CLI invocation with a fixture skill containing a PDF whose bytes match TM1 (Tool Parameter Abuse) — asserts the PDF is absent from components and produces no issues; also covers the repeatable form and the exclude-everything case
• Existing suite passes (make test-unit)

Test plan

• make test-unit is green
• make lint and make format-check are clean
• Manual: scan a skill containing a binary asset that previously triggered TM1; confirm the finding disappears with --exclude '*.pdf' and reappears without it