[umadevis1]

Title: feat(aviator): record superseded and covered issues in remediations.xml and report them when applying

Summary

When Aviator remediates several findings in the same file, one fix can resolve others: the other findings can be covered by it, or its fix can contain their narrower fixes and supersede them. This PR makes that explicit end to end. The relationship is written to remediations.xml, used when applying, and shown in the apply output. It works together with the Aviator server change that sends covered_by_issue_ids and superseded_issue_ids. Note: Cross-run case unsupported: if an issue was written with its own fix in an earlier run and a later run supersedes it, the earlier entry is not rewritten.

Changes

remediations.xml (AuditProcessor, remediations.xsd)

• A fix that supersedes others carries FileChanges plus <SupersedesPriorFix instanceId="…"/> for each.
• A covered or superseded issue is written as a reference: AuditComment plus <CoveredByPriorFix instanceId="…"/>, with no FileChanges.
  • An issue superseded by a fix drops its own narrow fix.
  • Supersede chains collapse to the widest fix, cycles are ignored, and references to a fix that isn't written are dropped.
• The server's notes in audit comments are rewritten to name the fix that is actually written. A covering fix that was superseded is replaced by the one that superseded it, and a superseding fix's note lists everything it absorbed. This applies to both audit.xml and the AuditComment in remediations.xml.
• The mapper reads the new elements into Remediation.

Wire format (issue.proto, GrpcUtil, Autoremediation): adds skip_reason = 2, covered_by_issue_ids = 3 and superseded_issue_ids = 4, matching the server proto. The fields are additive, so an older server simply sends none.

Apply (RemediationProcessor, RemediationProcessingState)

• Fixes are applied widest first, as before. After a fix is applied, the issues that reference it are resolved through it and counted once each. If the fix isn't applied, they are skipped with a reason.
• Selecting a fix, by request or by implicit approval, also processes and counts the issues that reference it.
• If --issue-ids names an issue with no fix of its own, the fix that resolves it is proposed through an ImplicitFixApprover, and every issue it resolves is listed. New -y/--confirm approves without asking. Otherwise fcli asks interactively, and declines in a non-interactive run, skipping the issue as "not confirmed". --preview never asks.

Output (AviatorRemediationMetricsHelper, RemediationMetric, SSC and FoD table columns)

• New counts: remediatedRemediation (applied + identical + superseded + covered), supersedesPriorFixRemediation, and coveredByPriorFixRemediation.
• New resolvedIssueIds: for each fix, the issues it resolves and how (coveredByPriorFix or supersedesPriorFix).
• implicitlyAppliedIssueIds appears only with --issue-ids.
• In issue-by-issue mode, the total includes implicitly applied fixes and the issues they resolve.

Testing
All existing testcases are passed along with the newly added testcases.