Add policy-aware audits

[ericmj]

Consumes the override protocol from hexpm/specifications#78 and hexpm/hex_core#215. Adds scoped advisory, retirement, and cooldown overrides, optional comments on every override type, policy-aware audit modes, separate policy/project suppression reporting, SARIF explanations, policy CLI output, and locked-dependency warning filtering.

Dependency resolution

mix deps.get and mix deps.update enforce the active policy while resolving dependencies. Allow and Deny overrides, advisory and retirement restrictions, cooldowns, and their scoped overrides determine which candidate releases the solver may select.

The warning pass then checks dependencies emitted by that resolution rather than scanning the entire lockfile. Matching Allow, advisory, and retirement overrides suppress only their accepted warnings, and project ignore_advisories and ignore_retirements entries remain additive. Policy thresholds do not suppress these post-resolution warnings; mix hex.audit --policy performs that full policy evaluation.

For a policy that overrides CVE-2026-4242 but not CVE-2026-4243, the matching advisory is omitted while the other advisory still warns:

$ mix deps.get
Active policy: myorg/strict-prod
New:
  policy_output_package 1.0.0 VULNERABLE!
    GHSA-policy-active (LOW)
    aka: CVE-2026-4243
    Separate parser vulnerability
    https://github.com/advisories/GHSA-policy-active
Found packages with security advisories, see above for details

Auditing

mix hex.audit always checks every locked Hex dependency. Its modes differ only in how the active policy classifies advisory and retirement findings:

Command	Policy evaluation
mix hex.audit	Preserves existing behavior. Reports every advisory and retirement, except project ignores.
mix hex.audit --policy-overrides	Applies matching Allow, advisory, and retirement overrides, but does not apply advisory thresholds or configured retirement reasons.
mix hex.audit --policy	Applies the complete policy, including advisory thresholds, retirement reasons, and matching overrides. Reports only policy-rejected findings as active.

Both policy modes require an active policy. Policy-accepted and project-ignored findings appear in separate sections and do not affect the exit code.

Given a High advisory overridden with the comment The affected parser is disabled and a separate Low advisory under a High policy threshold, --policy-overrides leaves the Low advisory active because no explicit override matches it:

$ mix hex.audit --policy-overrides
Advisories:
  policy_output_package 1.0.0 - GHSA-policy-active (LOW)
    aka: CVE-2026-4243
    Separate parser vulnerability
    https://github.com/advisories/GHSA-policy-active

Policy-accepted advisories:
  policy_output_package 1.0.0 - GHSA-policy-accepted (HIGH)
    aka: CVE-2026-4242
    Accepted parser vulnerability
    https://github.com/advisories/GHSA-policy-accepted
    Policy: The affected parser is disabled

Found packages with security advisories

--policy also accepts the Low advisory because it is below the policy threshold:

$ mix hex.audit --policy
Policy-accepted advisories:
  policy_output_package 1.0.0 - GHSA-policy-accepted (HIGH)
    aka: CVE-2026-4242
    Accepted parser vulnerability
    https://github.com/advisories/GHSA-policy-accepted
    Policy: The affected parser is disabled

  policy_output_package 1.0.0 - GHSA-policy-active (LOW)
    aka: CVE-2026-4243
    Separate parser vulnerability
    https://github.com/advisories/GHSA-policy-active
    Policy: Accepted by the active dependency policy.

The compatibility fixture confirms older Hex clients ignore unsupported override actions and remain restrictive. Updated clients warn about unsupported actions, ignore those overrides, and continue enforcing the remaining policy.

Validated with mix format --check-formatted, focused policy tests, command-output reproductions, and the full test suite.

[maennchen]

I'll do a manual test round, but the code looks great.