fix: honor nested Python roots and scan exclusions

[GuusDeKroon12]

Problem

Python coverage correlation assumed imports mapped directly beneath the scan root. Projects with a nested source root such as backend/app therefore reported covered modules as untested. Dynamic test loaders using importlib.util.spec_from_file_location or runpy.run_path were also missed. Separately, external-tool exclusions could remain relative, allowing Bandit to scan excluded vendor/reference trees. Cached detector output then preserved those invalid results.

Fix

• Resolve dotted Python modules against unique nested source roots, while failing closed when candidates are ambiguous.
• Recognize literal Python scripts loaded through spec_from_file_location and runpy.run_path, including Path(...) / ... chains.
• Prefer an exact root script over a same-named nested module and leave ambiguous basenames unresolved.
• Normalize external-tool exclusion paths to absolute paths.
• Bump the shared detector cache version so stale security results are invalidated.

Verification

• Focused regression suite: 16 passed.
• Full suite: 6679 passed, 164 skipped, 5 failed; the same five failures reproduce on untouched upstream commit 3a7735d5 (three bash source-directive assertions and one review-prompt assertion collected twice).
• Ruff passes on changed surfaces (ignoring only pre-existing E731 elsewhere in an already-touched test file).
• Verified against WanLoraTools: false test-coverage findings dropped from 11 to 0; Bandit scope dropped from 776 files to the intended 282; excluded reference-tree findings dropped to 0.