Add support for Bun lockfiles (bun.lock / bun.lockb)

Bun is becoming incredibly popular, but its lockfile is historically binary (`bun.lockb`) and recently text-based (`bun.lock`).

We need to add support for scanning Bun lockfiles within `lockcheck`. If the project uses Bun, `lockcheck` should ideally trigger `bun install -y --dry-run` or parse the `bun.lock` text file directly in a zero-dependency way to extract the same dependency graph mapping for our security analyzers.

**Acceptance Criteria:**
- Recognize `bun.lockb` or `bun.lock`.
- Extract package names, versions, and resolved URLs.
- Feed the data into the existing analyzers.