fix(yarn): support Yarn 4 tree-report audit

[Bafff]

Closes #332.

Summary

Yarn 4 changed yarn npm audit --json to an NDJSON tree-report stream (one advisory per line, shape {value, children: {ID, URL, Severity, ...}}), which is incompatible with the Yarn 2/3 aggregated report format. With v7.1.0 the parser silently emits zero findings on any Yarn 4 project.

This PR adds a dedicated Yarn 4 branch that:

• Adds yarnUsesBerryTreeReport (>=4.0.0) and parses each NDJSON line into the existing ProcessedAdvisory shape, so allowlist matching, fail levels, exit codes, and audit-ci.jsonc config behave exactly as on Yarn classic / 2 / 3.
• Synthesises a per-severity summary from the stream (Yarn 4 no longer emits a summary line) and prints it under --report-type=important|summary.
• Skips deprecation-only entries (lines without a https://github.com/advisories/... URL) to match npm audit / Yarn 2/3 parity.
• Derives allowlist paths from Dependents[], collapsing the root workspace (workspace:.) to a bare module name and prefixing non-root workspaces with their workspace name (so allowlist entries like GHSA-…|my-workspace>qs keep working).
• Updates README Requirements (drops the <4.0.0 cap) and Limitations (replaces the "not supported" note with a description of the new behaviour).

The npm and pnpm code paths are not touched — the change is gated entirely behind isYarnBerryV4.

Test plan

• New test/yarn-4-auditor.spec.ts (10 tests) covers: severity gating, allowlist by id, allowlist by dependents path, synthesised summary for summary and important report types, deprecation-line filtering for both summary and important output. All pass against bundled Yarn 4.2.2.
• New fixture test/yarn-4-deprecation-summary/ exercises a real lockfile where Yarn 4 emits both deprecation lines (inflight) and a critical advisory (open) — only the advisory ends up in findings/summary.
• End-to-end verified against a real Yarn 4 project: 20/20 advisories match yarn npm audit --json baseline, 6 deprecation lines correctly filtered, allowlist subtraction works (3 allowlisted → 17 failed; all 20 allowlisted → exit 0 "Passed yarn security audit").
• End-to-end verified against a real npm project: identical result vs. main (76 advisories on both), confirming the npm path is unaffected.
• tsc --noEmit clean.