feat: add minimum severity report filtering

[krishgera]

Summary

Adds a minimum severity filter for Grype report output.

Users can configure the threshold through:

• CLI: --min-severity <level>
• YAML: min-severity
• Environment: GRYPE_MIN_SEVERITY

Supported values are negligible, low, medium, high, and critical.

Behavior

• The threshold is inclusive.
• Findings with Unknown severity are excluded when filtering is enabled.
• Both regular and ignored matches are filtered.
• Filtering is applied once before the report is passed to the output presenters, keeping table, JSON, SARIF, template, and CycloneDX output consistent.
• Scanning, ignore/VEX processing, and --fail-on behavior remain unchanged.

Testing

Added coverage for:

• all severity thresholds;
• case-insensitive configuration;
• invalid and Unknown values;
• regular and ignored matches;
• empty filtered reports and metadata preservation;
• YAML, environment, and CLI precedence;
• --only-fixed and --only-notfixed;
• independent --fail-on behavior;
• table, JSON, SARIF, template, and CycloneDX output.

Validation performed:

• make format
• make lint
• focused unit tests
• compiled-binary CLI tests
• git diff --check

Closes #3529