Report lines of code and the main languages from cloc.txt

The project page takes the size from cloc's sum and names the three to
five largest languages, leaving out prose and data files such as Markdown,
text, CSV and JSON, and anything under 1% of the code beyond the third.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -39,8 +39,9 @@ report_generator from-folder --artifacts ./sample [--path <file-or-directory>]
 whose metadata is gone.
 
 The inputs are one SARIF file (`merged.sarif`, with one run per tool) and the vulnerability report
-(`vdr.json`); either is enough on its own. `metadata.json` is optional, and without it the project
-page is left out. The report has these parts:
+(`vdr.json`); either is enough on its own. `metadata.json` and `cloc.txt` (cloc's plain
+table, for the lines of code and the three to five main languages) are optional; without either the
+project page is left out. The report has these parts:
 
 1. the cover and a table of contents,
 2. a summary and the most critical issues across all sources,
@@ -98,8 +99,8 @@ vectors by `persistent_storage.utils.cvss_utils`.
 ### What it cannot fill in
 
 A field the artifacts do not answer is written as `<xxx>`, never guessed or quietly dropped. Today
-that is the manufacturer (unless given with `--manufacturer`), the analysed lines of code and the language
-breakdown.
+that is the manufacturer (unless given with `--manufacturer`), and, when there is no `cloc.txt`, the
+analysed lines of code and the language breakdown.
 
 A measured zero survives: `0 filtered` is a reading, and a blank is a gap.