[Feature] Add offline scanning with the local advisory DB

[sonukapoor]

Summary:
Adds the Phase 1 offline scan path so cve-lite can scan projects using the local advisory database with zero advisory API calls at runtime.

Closes #70.

What changed:

• wired --offline to use the default local advisory database
• added --offline-db support for explicit database selection
• switched offline advisory matching and detail loading to the local SQLite advisory source
• updated the CLI to clearly report offline mode and the active advisory source
• updated coverage notes to state that offline scans do not make outbound advisory API calls
• added tests for offline scanner behavior, CLI source messaging, and argument parsing

Notes:
This PR focuses on scan-time use of the local advisory database.

It builds on the prior schema and sync work, and does not change the standard online OSV scan path.

Verification:

• npm test
• npm run build
• manual smoke test with:
  • node dist/index.js advisories sync --output /tmp/advisories.db
  • node dist/index.js . --offline-db /tmp/advisories.db