feat(scanner): add --show to print git show per oops commit (#2)

[ChrisJr404]

Closes #2 — @peter17 asked for an option that prints `git show ` per oops commit so they could review the content manually or pipe it to an external tool.

Adds a `--show` flag with three useful modes:

Invocation	Behaviour
`--show`	Print `git show ` for every force-pushed commit. Skips trufflehog.
`--show --scan`	Print the diff AND run trufflehog on each commit.
`--scan` alone	Unchanged.
Neither	Unchanged (gather + report only).

The patch threads two kwargs (`show`, `scan`) into the existing `scan_commits` so the per-commit loop can switch behaviour without forking the clone / base-commit-identification / SHA-validation path. Each diff is preceded by a `[git show ]` header so multi-commit output stays parseable when piped, and `--no-color` is set so the output is grep-friendly.

A bad single `git show` (e.g. orphaned ref) is wrapped in the existing `RunCmdError` handler so it doesn't abort the rest of the run.

Test plan

• Syntax check passes (`python3 -c 'import ast; ast.parse(open(...).read())'`)
• argparse `--show` flag wires up correctly
• `scan_commits` signature picks up the new kwargs
• No-color output is grep-friendly
• (For maintainer) — exercise against a real org with known oops commits to confirm the rendered output reads well in a terminal

---

Note

Low Risk
Low risk: adds an optional CLI output mode and threads flags through scan_commits without changing the existing scan behavior unless the new flag is used.

Overview
Adds a new --show mode that prints git show --no-color <commit> output for each force-pushed commit, prefixed with a [git show <sha>] header for easier multi-commit parsing.

Updates scan_commits to accept show/scan toggles so --show can run alone (skipping trufflehog) or alongside --scan (print diff then scan), and adjusts main() to invoke scanning when either flag is set while handling git show failures per-commit without aborting the run.

^{Reviewed by Cursor Bugbot for commit 15ebf0d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.