[Feature] delta input on the Action, so adopters get the PR comment

The PR dependency-delta comment added in #1154 lives in this repo's workflows and runs node dist/index.js from the local checkout. Nobody using OWASP/cve-lite-cli@v1 gets it. action.yml has no reference to any of it.

That is worth closing, and the interesting part is that the general case is much simpler than the one we built.

Why the two-workflow split exists

GitHub forces GITHUB_TOKEN read-only for pull_request runs triggered from a fork, and no permissions: block overrides it. Every contributor PR on this repo is a fork PR, so a single workflow cannot comment. Hence the scan/post split with an artifact handoff.

That is an open-source problem. In an enterprise, and on any team where contributors push branches to the same repository rather than forking, the token is writable and a single job can scan and comment with no artifact, no workflow_run, and no second file.

Proposal

Add a delta input to the Action. When set, it additionally scans github.event.pull_request.base.sha, diffs the two finding sets with the existing renderer, and posts or updates one comment.

The scanning half is the only new work. The Action already scans the head; it has zero references to the base SHA today. The delta logic, the field allowlisting and the comment upsert all already exist in scripts/pr-scan-delta.mjs.

For a same-repo PR that is the whole feature, and an adopter gets it with one line:

- uses: OWASP/cve-lite-cli@v1
  with:
    delta: true

For fork PRs the Action cannot post, because of the token rule above. Two options, neither blocking this issue: fall back to writing the delta to GITHUB_STEP_SUMMARY, or document the two-workflow pattern for projects that need it.

Why this matters more than it looks

This is the difference between a feature that dogfoods on one repository and one that reaches every adopter. The 29 public repos running the Action currently surface nothing onto a pull request, which is the ceiling diagnosed when #1154 was written.

Scope

action.yml is 522 lines with 31 inputs, and eight docs files document inputs, so this wants its own PR rather than riding along on a rendering change. Deliberately kept out of #1154 and its follow-up for that reason.