File filtering rework + bugfix for loading cli arg environment variables from .env + workflow Python version pin

[kathamer]

This pull request introduces the following features:

• Complete rework of utils.filtering to introduce:
  • .gitignore style pattern matching for include/exclude rules: Inclusion/exclusion rules are now parsed using gitignore_parser, which makes them fully spec-compliant with .gitignore rules for more advanced file filtering
  • Command line file filtering arguments: The --exclude and --include CLI arguments can now be passed to SAIST to include extra file filtering rules on the fly, which are also parsed in .gitignore format and are appended to any rules gathered from saist.ignore/saist.include. (fixes Add command line file filtering #63)
  • Maximum line length checking: files or diffs with lines longer than the maximum line length, configurable via --max-line-length (default: 1000), are filtered out from analysis to avoid formatting issues with PDF generation and to avoid wasting tokens on processing minified code. This filter rule can be disabled for all files using --skip-line-length-check (fixes Truncate file lines greater than n characters #31)
  • Dry-run parameter and debug logging for included files: The --dry-run CLI argument can be used to load filtering rules and gather files to analyse, but exit before any analysis is done, which is useful in combination with verbose debug logging to see which files would be included for analysis in order to validate rule configuration.

And includes fixes for the following bugs:

• Run load_dotenv() in utils.argparser to ensure command line arguments that can be alternatively supplied using an environment variable, such as SAIST_LLM_API_KEY can be loaded from the .env file
• Pin Python version in SAIST workflow to 3.13 to fix failing check

[github-actions]

Application Security Assessment Summary

Critical Security Issues

Environment File Security
We identified a critical vulnerability in the saist/util/argparsing.py file where the application loads environment variables from a hardcoded '.env' file without proper security validation. This implementation fails to verify the file source or check file permissions, creating a significant security exposure. Attackers could potentially inject malicious environment variables by modifying or replacing the .env file, leading to system compromise or unauthorized access.

Immediate remediation is required to implement proper file path validation, enforce strict file permission checks, and provide users with configurable environment file paths that include appropriate security controls.

It's complaining about using .env, this is irrelevant and not a security risk

[SimonGurney]

LGTM 🏆