feat(workstream-c): add cheatsheet categorization and grouping

Implements Workstream C from the RFC: Autonomous LLM Pipeline for
OWASP Cheat Sheet to CRE Mapping.

- categorize_cheatsheet(record) with 29-label controlled taxonomy
- group_cheatsheets(records) with stable sha256-based group IDs
- Deterministic keyword/rule baseline, no LLM dependency required
- LLM-optional path with safe fallback on any failure
- UNCATEGORIZED sentinel stripped when real labels are present
- Uses CheatsheetRecord from application.defs.cheatsheet_defs (Workstream B, PR #921)
- 50 tests covering all acceptance criteria from RFC Issue C

Author: shreeshtripurwarcomp23-coder