enhancement: scan a docker save tarball or OCI layout as a source

Tracked by #247.

## Summary

`--filesystem` scans an extracted tree, so scanning a local image today means exporting it first. Accepting a `docker save` tarball or an OCI layout directory closes the container case without a registry client, and is the half of native image support that would have to be written before registries anyway.

## Current state

- Sources are `--path`, `--repo`, `--sbom-input` and `--filesystem`, [src/cli.rs#L215-L227](https://github.com/anistark/feluda/blob/83b4051/src/cli.rs#L215-L227). There is no image source.
- `scan_filesystem` takes one root and runs the OS catalogers and then the artifact walk over it, [src/filesystem/mod.rs#L75](https://github.com/anistark/feluda/blob/83b4051/src/filesystem/mod.rs#L75).
- The container case is answered today by piping syft into `--sbom-input`, or by `docker export app | tar -x -C rootfs` and then `--filesystem rootfs`.

## Design decisions

A registry client means auth against Docker Hub, ghcr and private registries, manifest index handling, platform selection and blob fetching, which is a large surface with nothing to do with licenses, and nobody has asked for `--image` by name since #251. A local tarball is layer squashing and whiteout handling on top of catalogers that already exist, with no network and no auth, and it can be judged on its own merits rather than as a down payment on registry support. Registry support stays unfiled.

## Proposed change

- Add an image source accepting a `docker save` tarball or an OCI layout directory. The flag is written as `--image-archive` below, the name is open.
- Squash layers in manifest order, honouring `.wh.` whiteouts and opaque directory markers, then hand the result to the existing filesystem scan.
- Select a platform explicitly when the input is a multi platform index, rather than guessing.
- Feed the SBOM writers the same way `--filesystem` does, so `feluda sbom spdx` over an image works.

## Acceptance criteria

- `feluda --image-archive app.tar --fail-on-restrictive` classifies a saved image with no other tool in the pipeline.
- A file deleted in a later layer does not appear in the findings.
- An OCI layout directory and a `docker save` tarball of the same image produce the same findings.
- A multi platform index without a platform selection fails with a message naming the available platforms.

## References

- OCI image layout, https://github.com/opencontainers/image-spec/blob/main/image-layout.md
- Whiteout rules, https://github.com/opencontainers/image-spec/blob/main/layer.md#whiteouts