Exclude external dependencies and resolve Bazel virtual include paths in HTML coverage reports

## Problem

The coverage report generated by `score_coverage` includes source entries that cannot be opened and includes third-party dependency sources.

In the coverage artifact from eclipse-score/baselibs#584:

- The index contains 22 `bazel-out/.../_virtual_includes/...` entries.
- The index contains 72 `external/...` entries, including `external/openssl+/*`.
- No HTML source pages are generated for either path category, so every corresponding index link is broken.

Virtual include paths represent workspace headers exposed through Bazel generated include trees and must remain represented by a working coverage-report entry. Third-party sources such as OpenSSL must not be reported as workspace coverage.

Coverage artifact:
https://github.com/eclipse-score/baselibs/actions/runs/34610832452/artifacts/10268069488

## Expected behavior

- Files reached through `bazel-out/.../_virtual_includes/...` are represented by working, clickable report entries, preferably normalized to their canonical workspace source paths.
- Files from external repositories, including `external/openssl+/*`, are excluded from the coverage report and its coverage totals.
- The report index contains no link for which a source HTML page was not generated.

## Acceptance criteria

- [ ] Coverage inputs under `bazel-out/**/_virtual_includes/**` resolve to a valid, clickable HTML report entry for the underlying workspace file.
- [ ] Coverage inputs from `external/**` are excluded from the report index and coverage calculations.
- [ ] The report generator does not emit broken source-page links.
- [ ] Automated regression coverage verifies virtual include handling and exclusion of an external dependency.