feat(security): scan Homebrew pkgs via brew-vulns

Add Audit.ScanHomebrew, which shells out to "brew vulns --json" (the
homebrew/brew-vulns tap) to cover the Homebrew formulae that ScanOSV
skips. It resolves each formula's source repo and version tag and
queries OSV via the GIT ecosystem.

brew-vulns exits 1 when vulnerabilities are found, so success is
detected by parseable JSON on stdout rather than the exit code; if the
tool is not installed the scan is skipped with a notice instead of
failing the audit. Qualitative severities are mapped through the
existing severityLabelToScore/cvssToSeverity helpers for consistency.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg

cmd/audit/main.go

@@ -62,6 +62,9 @@ Examples:
 	if err := audit.ScanOSV(); err != nil {
 		log.Fatalf("Error scanning OSV.dev: %v", err)
 	}
+	if err := audit.ScanHomebrew(); err != nil {
+		log.Fatalf("Error scanning Homebrew packages: %v", err)
+	}
 
 	// Get high-severity findings
 	highSev := audit.FilterByMinSeverity(7.0)