feat(cli): add --output to write the JSON report to a file

[LouisDeconinck]

What & why

Closes #166.

Large scans already emit a full JSON report, but the only destination was stdout — fine for a pipe into jq, awkward when the report is megabytes and the goal is to keep it.

diskern scan <dir> --json --output <file> writes the same pretty-printed document to the file instead of printing it. Decisions a reviewer might otherwise have to guess:

• stdout stays empty on --output. The issue's motivation is avoiding huge terminal output, so teeing to both would defeat the point. A one-line Wrote JSON report to … confirmation goes to stderr, matching how --rules already announces its external database — it can't corrupt a pipe.
• --output requires --json (clap requires, exit 2). The issue offered "reject clearly or document"; rejecting is the clearer contract since the flag has no meaning in the human-readable path. Happy to switch to implying --json if you'd rather.
• Write failures exit 1 with an anyhow context error naming the path ("could not write JSON report to '…'; check that the directory exists and is writable") plus the OS cause — same style as load_rules.
• No parent-directory creation — a typo'd path is more likely than intent to create directories, and the error message says what to check.

Docs: added the flag to the CLI README usage examples and flag table.

Checklist

• cargo fmt --all and cargo clippy --workspace are clean (ran -p diskern-core -p diskern-cli --all-targets -- -D warnings; workspace clippy needs the desktop webview deps)
• cargo test --workspace passes (ran -p diskern-core -p diskern-cli: 99 + all cli tests; 3 new e2e tests)
• Commits are small and focused (one logical change each)
• Doesn't weaken a safety principle (read-only scans, quarantine over deletion, deterministic verdicts)
• User-visible changes have a unique fragment in changelog.d/
• PR dependencies and overlapping component edits are identified
• Applicable CI passes; use the merge queue once it is enabled

[Muawiya-contact]

Thanks for contributing again, Louis! The JSON export meets #166, keeps stdout clean, and handles invalid arguments and write failures clearly. I reviewed the implementation and regression tests, and current CI is green; approved. Local Rust tests were blocked by a missing C linker, so Rust validation relies on the passing CI runs.