Capability-scoped reports: SAST, deps, images, secrets, licenses

On top of the shared report snapshot, narrow by SAST, dependency CVEs, images, secrets, and licenses—plus external redaction and SARIF limits.