fix(ghosthound): accept directories for --output

[JVBotelho]

Summary

• accept either an explicit file path or an existing directory for --output
• resolve and validate the destination before password prompting and LDAP collection
• return contextual path errors without creating parent directories
• enforce mode 0600 on new and reused output files on Unix before truncation
• document the CLI contract and cover it with focused cross-platform tests

Design decision

--output treats an existing directory as a request for <directory>/ghosthound_output.json; otherwise it treats the value as an explicit file path. A missing path ending in a directory separator is rejected as a missing directory. Parent directories are never created implicitly.

This stays in the ghosthound CLI crate and does not change the LDAP or OpenGraph libraries. The decision is recorded here rather than in a new ADR because it is a CLI contract, not a structural architecture decision.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-targets --all-features
• cargo test -p ad-secdesc-oracle
• cargo deny check
• manual CLI checks for an existing directory, missing parent, and missing directory with a trailing separator

Closes #16