Feat/configurable sanitizers and js precision (#32)

* chore: Exclude CLAUDE.md from Cargo.toml

* feat: Add configurable analysis rules and CLI commands for custom sanitizers and terminators

* feat: Enhance resource management and analysis efficiency

- Implemented parallel summary merging in `scan_filesystem` using rayon for improved performance.
- Introduced `GlobalSummaries::merge()` for efficient merging of summaries.
- Optimized file reading and hashing to eliminate redundant I/O operations.
- Added `should_scan_with_hash()` and `upsert_file_with_hash()` methods to streamline file processing.
- Enhanced taint analysis with in-place mutations to reduce memory allocations.
- Updated resource acquisition patterns to exclude false positives for `freopen` and wrapper functions.

* feat: Implement severity downgrade for findings in non-production paths and add source kind inference

* feat: Update versioning information in SECURITY.md for new stable line

* feat: Update categories in Cargo.toml to include parser-implementations and text-processing

* feat: Update dependencies in Cargo.lock for improved compatibility and performance

* feat: Update dependencies in Cargo.lock and Cargo.toml for improved compatibility

src/walk.rs

@@ -61,6 +61,11 @@ fn build_overrides(root: &Path, cfg: &Config) -> ignore::overrides::Override {
             tracing::warn!("invalid exclude‐dir pattern ‘{dir}’: {e}");
         }
     }
+    for file in &cfg.scanner.excluded_files {
+        if let Err(e) = ob.add(&format!("!{file}")) {
+            tracing::warn!("invalid exclude‐file pattern ‘{file}’: {e}");
+        }
+    }
 
     ob.build().unwrap_or_else(|e| {
         tracing::error!("failed to build ignore overrides: {e}");
@@ -83,6 +88,9 @@ pub fn spawn_file_walker(root: &Path, cfg: &Config) -> (Receiver<Paths>, JoinHan
     let follow = cfg.scanner.follow_symlinks;
     let max_bytes = cfg.scanner.max_file_size_mb.unwrap_or(0) * 1_048_576;
     let batch_size = cfg.performance.batch_size;
+    let max_depth = cfg.performance.max_depth;
+    let same_file_system = cfg.scanner.one_file_system;
+    let require_git = cfg.scanner.require_git_to_read_vcsignore;
 
     // ----- 3  the background walker thread ---------------------------------
     let handle = thread::spawn(move || {
@@ -96,11 +104,18 @@ pub fn spawn_file_walker(root: &Path, cfg: &Config) -> (Receiver<Paths>, JoinHan
             "starting directory walk"
         );
 
-        WalkBuilder::new(root)
+        let mut builder = WalkBuilder::new(root);
+        builder
             .hidden(!scan_hidden)
             .follow_links(follow)
             .threads(workers)
             .overrides(overrides)
+            .same_file_system(same_file_system)
+            .require_git(require_git);
+        if let Some(depth) = max_depth {
+            builder.max_depth(Some(depth));
+        }
+        builder
             .filter_entry(|e| {
                 e.file_type()
                     .map(|ft| ft.is_dir() || ft.is_file())