feat: add OWASP-aware security metadata, trust-policy enforcement

[alxxjohn]

PR Summary

This PR expands CodeGuard’s security and reporting surface while tightening scan behavior and cleanup across the repo.

• adds OWASP-aware rule metadata and coverage reporting, introduces trust-policy guards around config-driven commands and custom AI endpoints, and improves related CLI and SDK surfaces.
• It also cleans up several quality issues by reducing declaration-heavy files, fixing allocation-heavy string building, and tightening CI test-quality handling around Go TestMain bootstrap files.

Highlights

• Adds OWASP security metadata, coverage reporting, and related CLI/SDK support.
• Introduces trust-policy enforcement for config-supplied commands and non-allowlisted AI endpoints.
• Improves SARIF and reporting structure to carry richer security metadata.
• Cleans up quality findings by splitting overloaded files and removing low-value narrative comments.
• Fixes allocation-heavy string assembly in CLI rule output.
• Refines CI/test-quality behavior and repo configuration to avoid false positives around TestMain.

Validation

• Targeted Go tests passed for updated check behavior and touched packages.
• codeguard scan -config .codeguard/codeguard.yaml now passes with 0 findings.