fix: apply ca-cert to main scan path via cert-aware fetch

[sonukapoor]

Fixes #839.

--ca-cert was only applied by setting NODE_EXTRA_CA_CERTS at runtime, which may not affect undici's already-initialized TLS context in Node.js 18+. On the advisory sync path (advisories sync), the download hits storage.googleapis.com, which corporate proxies typically do not intercept - so sync worked. The main scan path hits api.osv.dev directly, which proxies do intercept, causing certificate errors that were not recoverable with the env var approach alone.

What changed:

• Added createCertAwareFetch(caCertPath) to src/utils/network.ts - builds a fetch-compatible wrapper using node:https with a custom Agent carrying the corporate CA cert, appended to the system root bundle (tls.rootCertificates) so existing trusted CAs are not replaced
• Added optional fetchImpl parameter to OsvAdvisorySource so the cert-aware fetch can be injected at the advisory source level
• Threaded fetchImpl through createAdvisorySource in scanner.ts, scanPackages, handleMultiFolderScan, and the scanProject helper in index.ts so every scan network call uses the cert-aware fetch when --ca-cert is configured
• NODE_EXTRA_CA_CERTS assignment is kept as a belt-and-suspenders fallback for any other code paths

The Agent is initialized lazily on the first request, so the cert file is not read until after validateOptions has already verified the path exists and is readable.

Closes #839