Improve dependency override governance gates

[DENGXUELIN]

Summary

• add dependency override/replacement governance gates for npm/Yarn/pnpm, Go replace, Rust [patch], Maven/Gradle substitutions, and Python constraints/direct URLs
• add an override/replacement review table to the dependency scan output template
• add vulnerable and benign fixtures covering risky git/local-path/downgrade rewrites and governed fixed-version overrides

Why this is different from existing #1649 attempts

• Existing PRs Add dependency override governance gates #1650 and Add dependency override governance gates #1684 are SKILL.md-only implementations.
• This PR adds local vulnerable/benign fixtures so maintainers can evaluate both the dangerous rewrite cases and the false-positive boundary for governed fixed-version overrides.

Validation

• git diff --check origin/main...HEAD
• Markdown fence balance check for SKILL.md and both fixture files
• ASCII check for touched files
• content marker check for DEP-OVERRIDE-*, override review output, risky git override, governed mitigation, and Cargo override references
• git merge-tree --write-tree origin/main HEAD

Closes #1649