feat: add lint.exclude_paths and secrets.allowlist config

[Kodaxadev]

Summary

• Adds lint.exclude_paths config field — path prefixes excluded from file-length checks
• Adds secrets.allowlist config field — path prefixes excluded from credential scanning
• Adds --config=<path> CLI flag to governance-report.js for external config files
• Adds config input to action.yml so consuming repos can provide their own codewarden.json
• Documents both fields in CONFIGURE.md with examples

Motivation

When running Code-Warden as a CI gate on real repos, the governance report fails on:

• Documentation files that legitimately exceed 400 lines (design docs, research spikes, READMEs)
• Localhost development database URLs that match the credential regex but aren't real secrets

Without exclude support, repos must either weaken global thresholds or accept permanent CI failures on known-safe paths.

Usage

{
  "thresholds": { "max_file_length": 400 },
  "lint": {
    "exclude_paths": ["Documents/", "Documents/Obsolete/"]
  },
  "secrets": {
    "allowlist": ["scripts/indexer.config.toml", "indexer/src/api_auth.rs"]
  }
}

In GitHub Actions:

- uses: Kodaxadev/Code-Warden@v3.4.0
  with:
    config: codewarden.json
    sarif: "true"

Test plan

• All 32 existing tests pass unchanged
• Config loader returns empty arrays by default (backward-compatible)
• Path matching uses prefix comparison with / normalization

🤖 Generated with Claude Code