feat: add selective entity exclusions

[etiennetremel]

Adds configurable entity exclusions while keeping all recognizers enabled by default:

• Supports exclusions across scan, stream, audit, and pre-commit
• Rejects unknown entity names
• Preserves nested URL findings, so credentials and PII inside excluded URLs remain detectable
• Adds ScannerBuilder::exclude_entities
• Documents canonical entity names and configuration
• Builds scanners once for audit/pre-commit, ensuring configuration errors propagate

Close #1.

Usage

Cli:

cloakrs --exclude-entities url,hostname,user-path stream

In toml:

exclude_entities = ["url", "hostname", "user-path"]