fix: split CVE reports by scope and correct severity counting

[deleonio]

Motivation

• Ensure CVE summaries reflect actual severity tallies instead of misclassifying known severities as unknown by fixing the counting logic.
• Provide separate visibility for production-only and all-dependencies audit results so the overview distinguishes risks for production installs vs full dependency graph.

Description

• Extend scripts/generate-cve-report.mjs to accept --input-prod and --input-all in addition to the legacy --input, and add argument validation for the new modes.
• Replace the inline parsing/aggregation with collectAdvisories and buildReportSection helpers that normalize severities and count them using an explicit === undefined check so zero/known values are counted correctly.
• Emit separate report sections when both production and all-dependencies audits are provided, otherwise fall back to the single-input behavior.
• Update .github/workflows/cve-overview.yml to run pnpm audit --json --production and pnpm audit --json and pass both outputs to the report generator.

Testing

• Ran repository formatting via pnpm format, which completed successfully.

---

Codex Task

[github-actions]

Netlify Draft Deployment
URL: https://69802f221e35dac19e38b91a--kolibri-public-ui.netlify.app
Logs: https://app.netlify.com/projects/kolibri-public-ui/deploys/69802f221e35dac19e38b91a