[scanner] Confidence seeds: absence-based rules → low / warn

[emmanuelgjr]

Classification: STRUCTURAL

Absence-of-evidence rules (P07.x, P08.x, P16.1, and the absence branches of P17.1–5 and P20) are weak signals. Set confidence: low and signal: warn on each once the rules YAML lands (PR-03). SARIF level and report rendering already consume the confidence field. No regex change — just the confidence/signal fields plus a note in the rule's description.

---

Blocked on Phase 1. Mergeable after the fixture corpus and self-test CI land (PR-04 / PR-06) — feel free to draft now. Add your positive + negative test snippets to the fixture app when you open the PR.

Never paste real credentials. Use obviously fake canonical values (e.g. sk-proj-FAKE00000000000000000000000000).