Allow configuration via .lockcheckrc.json

Right now, `lockcheck` runs all analyzers automatically. Some teams might have internal packages that look like typosquats, or custom private registries that trip the `registry` anomaly detector.

We should support an optional `.lockcheckrc.json` file in the root directory that allows users to ignore certain packages, scopes, or disable specific analyzers.

**Example config:**

```json
{
"ignorePackages": ["my-internal-tool"],
"ignoreScopes": ["@mycorp"],
"disableAnalyzers": ["freshness"]
}
```