perf(039): strip sarif_raw from report API (2.1MB -> 2.9KB)

SARIF raw data can be 2MB+ (Semgrep includes all rule definitions).
Web UI was stuck on "Loading scan report..." because of this.
Now stripped by default; add ?include_sarif=true for CLI --output sarif.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

internal/httpapi/security_scanner.go

@@ -210,6 +210,14 @@ func (s *Server) handleGetScanReport(w http.ResponseWriter, r *http.Request) {
 		s.writeError(w, r, http.StatusNotFound, err.Error())
 		return
 	}
+
+	// Strip sarif_raw from response unless ?include_sarif=true (it can be 2MB+)
+	if r.URL.Query().Get("include_sarif") != "true" {
+		for i := range report.Reports {
+			report.Reports[i].SarifRaw = nil
+		}
+	}
+
 	s.writeSuccess(w, report)
 }