Only include published evidence when export scope is published

[caitmich]

Summary

Exporter#nodes and the default template's issue.evidence_by_node call both read issue.evidence/an unscoped evidence association directly, bypassing the Published/All export scope that content_service.all_issues already respects. A Published-scope export could still leak Draft/Ready-for-review Evidence content into the exported HTML.

• Exporter#nodes now derives its node list from content_service.all_evidence instead of unscoped evidence reachable from issues.
• The default template (templates/default_dradis_template_v3.0.html.erb) now calls issue.evidence_by_node(scope) directly. scope is the Dradis::Plugins::Export::Base accessor already set from the export's :published/:all scope at initialization — no separate exporter-level helper is needed, since it would just wrap Issue#evidence_by_node under the same name.
• Requires Issue#evidence_by_node to accept a scope argument — see dradis-ce PR #1684 (and its Pro sync, dradis-pro #2939).
• Depends on dradis-plugins gem changes (PR #127, branch feature/evidence-content-service-scope) for all_evidence — needs a real dradis-plugins release + Gemfile bump before this merges.

Part of the same review-comment follow-up as qa/add-evidence-review-state (Evidence now has an independent Draft/Ready for review/Published state).

Testing Steps

From the Dradis Pro app directory, with this gem checked out at a sibling path, temporarily point the Gemfile at this branch/path and run:

bin/rspec [dradis-html_export path]/spec/lib/dradis/plugins/html_export/exporter_spec.rb

Assert all examples pass, confirming the evidence scope context: a Published-scope export includes only Published evidence content, an All-scope export includes both Published and Draft evidence content.

Check List

• Added a CHANGELOG entry
• Added specs