feat: scope PR annotations to changed files with --changed-from

[mackeh]

Implements major Phase 2 progress across PR signal quality and multi-language coverage.

What changed

• Added aishield scan --changed-from <ref> to scope scans to changed files
• Wired PR annotation workflow step to use PR base SHA
• Added optional SAST bridge orchestration: --bridge semgrep,bandit,eslint|all
• Bridge engines run in parallel and normalize findings into AIShield unified schema
• Added config support: bridge_engines: []
• CI now installs bridge tools by default (Semgrep/Bandit/ESLint), toggleable via repo vars
• Fixed SARIF/annotation line+column clamping for strict SARIF validity
• Added initial Go/Rust/Java language support in source scanner
• Added starter Go/Rust/Java rulepacks (auth/crypto/injection)
• Added vulnerable fixture suites for Go/Rust/Java
• Updated docs and changelog for all changes

Why

• Reduce PR annotation noise and improve review relevance.
• Deliver initial multi-engine orchestration and normalization from the roadmap.
• Expand language coverage beyond Python/JavaScript with immediate usable detections.

Validation

• cargo fmt
• cargo test
• aishield scan ... --changed-from ... behavior
• aishield scan ... --bridge all (with graceful warnings locally when tools missing)
• CI run with bridge installs enabled and SARIF upload success

[github-advanced-security]

AIShield found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.