An unset severity-cutoff should default to the value of fail-on-severity if there is a configuration

It appears to me that not setting it causes the CLI invocation to pass in `--fail-on medium` which takes precedence over the value in our config file.

Start by reproducing the CLI invocation with an unset severity-cutoff and a configured fail-on-severity, then trace the configuration handling that supplies --fail-on medium. Done means an unset severity-cutoff inherits the configured fail-on-severity value without overriding it, while an explicitly set cutoff remains effective.

Written by the indexing model from the issue text.