Phase 3: add --baseline/--update-baseline ratchet mode

[advaitpatel]

Summary

Adds baseline/ratchet mode so --fail-on can be adopted on existing projects without
pre-existing findings blocking every build - a gap identified against the cve-lite-cli
UX/feature benchmark.

Changes

• --baseline FILE: path to a baseline file. Combined with --fail-on, only findings not
  already present in the baseline trigger the gate.
• --update-baseline: writes the current scan's findings to --baseline instead of
  gating. Requires --baseline (exits 2 otherwise).
• New docksec/baseline.py: fingerprints findings by VulnerabilityID|Target|PkgName
  (stable across scans of the same Dockerfile/image/compose file), and provides
  load/save/diff helpers.
• Missing baseline file is treated as empty, so a --fail-on --baseline run against a
  file that doesn't exist yet behaves like no --baseline at all, until
  --update-baseline is run once.

Testing

• ruff check . passes.
• pytest: 157 passed (+16: baseline module unit tests, CLI wiring/gate integration tests).
• Manual runs verified: --update-baseline writes a valid baseline file and does not gate;
  a baselined finding no longer trips --fail-on; a new finding still trips it; missing
  --baseline with --update-baseline exits 2.