feat: make --plugins additive by default, and introduce --no-default-plugins

[G-Rath]

Resolves #1958
Resolves #2178

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.40%. Comparing base (18100e2) to head (1b5718a).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2210      +/-   ##
==========================================
- Coverage   67.62%   67.40%   -0.23%     
==========================================
  Files         170      170              
  Lines       16336    16394      +58     
==========================================
+ Hits        11047    11050       +3     
- Misses       4609     4664      +55     
  Partials      680      680              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull Request Overview

This PR changes the --plugins flag behavior to be additive by default (adding to default plugins) and introduces a new --no-default-plugins flag for excluding defaults when users want to run only specific plugins.

• Changed plugin resolution logic to append enabled plugins to defaults instead of replacing them
• Added PluginsNoDefaults field and --experimental-no-default-plugins flag
• Updated tests to separate behavior testing between default-inclusive and default-exclusive scenarios

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/osvscanner/scan.go	Modified plugin resolution logic to append enabled plugins to defaults
pkg/osvscanner/osvscanner.go	Added PluginsNoDefaults boolean field to ExperimentalScannerActions struct
docs/migrating-from-scalibr.md	Updated documentation to explain new additive behavior and no-default-plugins flag
docs/manual-plugin-selection.md	Updated plugin selection documentation with new flag descriptions
cmd/osv-scanner/scan/source/command_test.go	Split tests into separate functions for with/without defaults scenarios
cmd/osv-scanner/scan/source/snapshots/command_test.snap	Updated test snapshots for new test organization
cmd/osv-scanner/scan/image/command_test.go	Split image tests into with/without defaults scenarios
cmd/osv-scanner/scan/image/snapshots/command_test.snap	Updated image test snapshots
cmd/osv-scanner/internal/helper/getters.go	Added PluginsNoDefaults field extraction from command flags
cmd/osv-scanner/internal/helper/flags.go	Added --experimental-no-default-plugins flag definition

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[another-rex]

LGTM, thanks!