fix(supply_chain): parse pyproject.toml with tomllib instead of requirements regex

[Shrotriya-lalit]

Problem

_analyze_dependencies routed pyproject.toml through
_extract_packages_from_requirements, a line-by-line regex designed for
requirements.txt format. TOML keys such as requires-python, name,
description, and authors all look like dependency strings to the regex,
producing false-positive SC5/SC6 findings on standard PEP 621 metadata
fields.

Example: a pyproject.toml with name = "myproject" triggered an SC6
(typosquatting) alert for a non-existent package called myproject.

Root Cause

The requirements parser treats every non-comment line as a potential package
specifier. TOML files have a completely different structure and must be parsed
semantically, not line-by-line.

Fix

Add _extract_packages_from_pyproject(content) using tomllib (Python 3.11+
stdlib, no new dependencies) that reads only the three PEP 621 / PEP 517
dependency arrays:

• [project].dependencies
• [project.optional-dependencies].<group>
• [build-system].requires

A frozenset of PEP 621 metadata keys (name, version, description,
authors, …) acts as a secondary guard. Malformed TOML is caught by
TOMLDecodeError and returns [] so the analyzer never crashes.

def _extract_packages_from_pyproject(content: str) -> list[tuple[str, str | None, int]]:
    try:
        data = tomllib.loads(content)
    except tomllib.TOMLDecodeError:
        return []
    # reads only project.dependencies, project.optional-dependencies, build-system.requires
    ...

Tests

• Standard [project].dependencies extracted correctly
• [project.optional-dependencies] groups extracted
• [build-system].requires extracted
• Malformed TOML returns [] without exception
• PEP 621 metadata keys (name, version, description) never treated as packages
• End-to-end false-positive regression: pyproject.toml with metadata fields produces no SC5/SC6 findings

Closes #2

Checklist

• make lint passes
• Tests added covering false-positive regression
• DCO sign-off on commit (git commit -s)