Add Swift Package Manager scanner

[jthDEV]

Summary

• Ports dependency resolution from the now-retired ts-spm plugin into ts-scan's own Scanner interface, replacing the need for a separate plugin
• Detects Package.swift and parses the JSON tree produced by swift package show-dependencies --format json into ts-scan's Dependency/DependencyScan model, using the swift purl type as key/purl prefix
• Registers SwiftScanner alongside the other package-manager scanners; --swift:ignore, --swift:executable and --swift:forward become available like for the other PM-backed scanners

Dependencies added

None — uses only the swift executable already required by Swift Package Manager projects.

Test plan

• pytest tests/test_swift.py — accepts()/scan() unit tests with a mocked swift package show-dependencies JSON tree (including diamond-dependency de-duplication)
• pytest tests/ — full existing suite still passes

[jthDEV]

Rebased onto current main (the branch had drifted 11 commits behind) and updated by force-push.

Conflicts resolved: scanner registry in src/ts_scan/__init__.py, the PM option list in README.md, and the [Unreleased] section in CHANGELOG.md.

The rebase surfaced a real defect. This branch predates Return an iterable from scanner implementations, so scan() still returned an optional single DependencyScan, which makes _execute_scans fail with 'DependencyScan' object is not iterable. The same defect existed on #32. Commit 7780456 returns a list of scans (empty when swift produces no output) and adapts the tests, which called scan() directly and therefore never hit it.

README (as the last of the three PRs). Commit 2bf7364 brings the ecosystem documentation up to date. The description named only a fraction of the available scanners; it now names all of them and adds a table stating per ecosystem how a project is detected, where the resolved graph comes from, and which executable is required — including Composer (#38) and CocoaPods (#32). The table makes explicit which scanners work from a committed lockfile alone, i.e. without toolchain or network access in CI.

Therefore merge this one last: #38 → #32 → #31. The README and option list in this PR already describe --composer:* and --cocoapods:ignore, which only exist once the other two have landed. If the order changes, this branch needs another rebase first.

Full suite green (43 passed).

🤖 Generated with Claude Code