feat: Add baseline file support to suppress known findings in CI

[Nanle-code]

Overview

Teams that adopt ChainProof mid-project face a painful onboarding experience: the first scan often surfaces dozens of pre-existing findings that the team cannot fix immediately. Without a way to suppress known issues, the CI gate will permanently fail until all findings are resolved — blocking new feature work. A baseline file mechanism solves this by letting teams explicitly acknowledge existing findings and only fail CI on new issues.

Problem Scenario

1. Team runs ChainProof for the first time on a codebase with 40 pre-existing findings
2. CI gate is configured to fail on high severity
3. 15 of those findings are high severity — all pre-existing, none exploitable in their context
4. Team cannot ship anything until all 15 are fixed
5. Team disables ChainProof entirely

A baseline file lets the team say: "These 15 issues are known. Alert me if anything new appears."

Proposed Design

Creating a Baseline

chainproof scan contracts/ --create-baseline .chainproof-baseline.json

Generates a baseline file:

{
  "version": "1.0",
  "createdAt": "2025-06-19T00:00:00Z",
  "entries": [
    {
      "fingerprint": "sha256-of-rule-id+file+line+snippet",
      "ruleId": "CP-107",
      "file": "contracts/Vault.sol",
      "line": 42,
      "title": "Reentrancy vulnerability"
    }
  ]
}

Using a Baseline

chainproof scan contracts/ --baseline .chainproof-baseline.json

• Findings present in the baseline are marked suppressed: true in the result
• Suppressed findings are excluded from severity-based exit code logic
• Suppressed findings still appear in reports (dimmed/marked) for transparency
• Exit code 1 only if new (non-baselined) critical/high findings are found

Fingerprinting Strategy

A finding's fingerprint is computed as:
SHA-256(ruleId + normalized_file_path + line_number + first_30_chars_of_snippet)

This is stable across minor code formatting changes but invalidates when the vulnerable code moves or changes.

Acceptance Criteria

• --create-baseline <file> CLI flag generates baseline JSON
• --baseline <file> CLI flag loads and applies baseline
• ScanConfig.baselinePath?: string field added
• Fingerprinting algorithm documented and deterministic
• Suppressed findings marked in all report formats (Markdown, JSON, table)
• GitHub Action supports baseline-file input pointing to a committed baseline
• VS Code extension has chainproof.baselineFile setting
• Baseline entries that no longer match any finding are reported as stale (warning)