Do not silently drop findings listed in a baseline inside the scanned tree

[arpitjain099]

Opening this as a public PR per your note on GHSA-7875-p889-5wvx.

The baseline is read from .pyspector_baseline.json inside the directory being scanned, so when that directory came from somewhere else, the file that decides which findings to drop came from there too. The part that bothered me is not the trust question, which you have already called out of scope, but that it happens with no output at all: Baseline-ignored is only printed under --stats, so a scan can report clean while silently dropping results.

Two changes:

• print the suppressed count whenever it is non-zero, naming the file that did it
• add --no-baseline for callers that never want one picked up from the tree, which is mainly CI scanning branches it did not write

Behaviour is otherwise unchanged, and a baseline you put there yourself still works exactly as before. You just get told.

Checked in a python:3.12-slim container, built from source, on a file containing os.system and eval:

run 1  no baseline                findings: 1
run 2  baseline present           [!] 1 finding(s) suppressed by '/tmp/v/.pyspector_baseline.json'.
                                  Use --no-baseline to ignore it.        findings: 0
run 3  --no-baseline              findings: 1

Happy to change the wording or the colour of the notice if you would rather it read differently.

I used AI assistance while working on this. The three runs above are mine, built from source at 7492032 since the PyPI wheel needs pkg-config and libssl-dev to build.