Phase 2a: add --severity flag for image vulnerability scan scope

[advaitpatel]

Summary

Adds a --severity flag to choose which severity levels the image vulnerability scan
(Trivy) reports, replacing the previously hardcoded CRITICAL,HIGH at the CLI call sites.
First of the Phase 2 (CI primitives) sequence.

Changes

• --severity <levels>: comma-separated severity levels. Resolution precedence is
  --severity > DOCKSEC_DEFAULT_SEVERITY env > CRITICAL,HIGH default.
• Values are validated against the known severities; an invalid value prints a clear
  error and exits non-zero.
• The active severity filter is shown in the run metadata.
• Threaded into full, image-only, and compose scans (the scanner methods already
  accepted a severity parameter).

Scope / non-breaking note

--severity controls the Trivy image vulnerability scan. Compose static
misconfiguration findings are a curated rule set and are always reported regardless of
this flag, so compose output is unchanged.

Testing

• ruff check . passes.
• pytest: 104 passed (+2: invalid value rejected; valid value normalized and passed
  to the scan call).
• Manual runs verified: default (no flag) unchanged, custom --severity, env override,
  and invalid-value rejection.