docs: clarify dependency remediation scope in README

[sonukapoor]

Summary

This PR clarifies how CVE Lite CLI describes remediation in the README.

A reviewer raised a good question about the phrase “guided remediation” in malicious package scenarios. In those cases, upgrading dependencies alone is not enough. Teams may also need to treat the situation as a potential security incident.

What changed

• narrowed broad wording such as:
  • fix plan → dependency fix plan
  • remediation plan → dependency remediation plan
• updated comparison wording:
  • Guided remediation → Dependency remediation guidance
• added an explicit note in the malicious package section that if a malicious package was installed and executed, upgrading/removing the dependency may not be sufficient on its own and incident-response steps may be required

Why

This makes the README more precise and avoids over-claiming.

CVE Lite CLI helps developers:

• identify vulnerable dependencies
• separate direct vs transitive issues
• prioritize upgrades
• act on dependency findings faster

It is not positioned as an incident-response or compromise-forensics tool.

Issue

Closes #120