feat: structured logging to stderr with --log-level flag

[mendsec]

Context

When catnet is embedded in larger automation pipelines, operators need machine-parseable log lines on stderr (separate from JSON scan results on stdout). Add --log-level (debug|info|warn|error) using log/slog (stdlib, Go 1.21+) so that warning events from catnet-core (EventWarning) are emitted as structured JSON log lines to stderr.

Acceptance criteria

• catnet scan ... --log-level debug emits JSON log lines on stderr, scan results on stdout
• Default log level is "warn" (no change to current default UX)
• EventWarning from catnet-core surfaces as {"level":"WARN",...}
• --quiet suppresses progress but not warn/error log lines
• No slog output appears in JSON scan result payload