Report CipherCell SCA first, then Lynkeus, then SAST, everywhere

The dependency check is named CipherCell SCA throughout, and the sources
keep one order on the cover, in the summary, the most-critical table and
the sections. Lynkeus before SAST no longer depends on the run order in
the SARIF file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -45,8 +45,9 @@ project page is left out. The report has these parts:
 
 1. the cover and a table of contents,
 2. a summary and the most critical issues across all sources,
-3. the dependency vulnerabilities from the VDR,
-4. one section per SARIF run, named after its tool (e.g. CipherCell Lynkeus, CipherCell SAST),
+3. the dependency vulnerabilities from the VDR, as CipherCell SCA,
+4. one section per SARIF run, named after its tool: CipherCell Lynkeus, then CipherCell SAST, then
+   any other tool in the order its run appears,
 5. at the end, *False Positives and Suppressed Findings*: every result Polygraph classified as a
    false positive or that carries a SARIF suppression (such as the areas Lynkeus ruled out), with
    the reason.