feat(cli): add --min-severity filtering option

[NhanAZ]

What changed

Added a new --min-severity <level> CLI option to filter out findings below a certain severity threshold. Supported levels are info, warning, and error.

Why

When scanning large repositories, users may want to focus only on critical risks (e.g., hardcoded credentials) rather than being distracted by lower-severity warnings (e.g., prompt artifacts or unpinned dependencies). This allows integrating OPK more strictly into CI pipelines where --min-severity error would fail the build, but warnings would not clutter the output.

Testing

• Unit tests added to tests/scanner/scanner.test.ts to verify findings are correctly filtered.
• Manual CLI test confirms that running opk scan --min-severity error on the prompt-artifacts fixture (which only contains warnings) returns 0 findings.
• Total tests passed: 40/40.

Risks

None. This strictly reduces the volume of reported findings when the flag is used. The default behavior (no flag provided) remains unchanged (reports all findings with level >= info).

Follow-up

Consider adding file/path exclusion patterns next.