docs(code-scanning): bring your own scanner (P2.2) — HOLD OPEN

[maximelb]

HOLD OPEN. Docs for roadmap 15 P2.2, stacked on the held-open code-lane docs branch (#355) so the diff is only the new material. Retarget to master when #355 merges.

Adds a "Bring your own scanner" section to code-scanning.md:

• cloudsec code ingest — push SARIF / CycloneDX / the scanner's own report for one repository.
• Why a pushed finding is the same finding rather than a copy of it, and the three rules that follow: a push closes only what it previously reported; what the format cannot carry is reported in notes rather than guessed; credential findings in a third-party document are refused, with the reason.
• cloudsec code scan [--ingest] for local/CI scanning, including why secret scanning is off by default there.
• A GitHub Actions recipe (no LimaCharlie CI minutes — the work happens in the customer's runner), plus the variant that pushes an existing tool's SARIF.

Also removes "Bring-your-own scan results" from the Not yet available list, which is what this ships.

[maximelb]

Superseded by #362, which consolidates this branch with the other code-lane docs branches into one page set off master and reconciles every claim against the shipped code (nine differences are listed in that PR's body). Leaving this open rather than closing it — Maxime closes.