feat(cli): load rules database from file

[alexsmolya]

What & why

Fixes #68

diskern scan can now accept an optional external rules database:

diskern scan <path> --rules ./my-rules.json

Without --rules, the CLI continues to use the embedded rules database. A supplied file is deserialized through the existing RulesDb model, with explicit errors for unreadable files and malformed JSON. Human-readable output identifies the external rules source, while JSON output remains valid on stdout. The change stays at the CLI boundary and does not move classification logic out of diskern-core.

The user-visible feature is documented in CHANGELOG.md.

Validation

• cargo fmt --all
• cargo +1.96.0 clippy -p diskern-core -p diskern-cli --all-targets -- -D warnings
• cargo +1.96.0 test -p diskern-core -p diskern-cli
• git diff --check

All passed. The focused suite includes regression coverage for embedded rules, valid external rules, missing files, and malformed JSON.

Checklist

• cargo fmt --all and the required core/CLI clippy validation are clean
• The required core/CLI test suite passes
• Commits are small and focused (one logical change each)
• Doesn't weaken a safety principle (read-only scans, quarantine over deletion, deterministic verdicts)
• Workspace-wide GUI validation was not run; it is outside the repository-required core/CLI gate