spec-go-signing-tool: three gaps between the spec and the implemented CLI

Found while reviewing owncloud/ocsign#21. All three are spec-side; the
implementation is the more complete artifact in each case.

1. §3.6 does not list the core mode top-level directory exclusions. Core
mode drops the top-level data, themes, config, apps, assets and
lost+found directories wholesale — transcribed from the legacy PHP
ExcludeFoldersByPathFilterIterator so the manifest matches the verifier. §3.6
lists core/signature.json, the cruft, core/js/mimetypelist.js, .htaccess
and .user.ini, but not these six, and they appear nowhere else in the spec.
They are normative — a verifier written from the spec alone would disagree with
ocsign on every real server root. ocsign's README cites §3.6 for them, which
is where a reader would reasonably look.

2. §2 flag list is missing --allow-vcs and --version. Both are
implemented; --allow-vcs also gates a new exit-1 condition that §2's exit code
table should mention (--path is a repository checkout).

3. §3.1 says nothing about resolving a symlinked --path. The rule that a
symlink is never followed is about entries inside the tree. The root itself
must be resolved before the walk, or filepath.WalkDir-style enumeration yields
the link and stops — producing an empty manifest under a perfectly valid
signature. ocsign resolves it; the spec should require it so the verifier does
too.

Start with spec sections §3.6, §2, and §3.1, then compare each requirement with the implemented ocsign CLI and the README references mentioned in the issue. Update the normative specification to cover the directory exclusions, flags and exit condition, and symlinked root paths; done means a verifier following the spec agrees with the implementation.