Let the project name and the manufacturer be supplied on the command line

Neither is recorded in the artifacts: the metadata's repository_name is
empty and nothing names a manufacturer. --project wins over the metadata.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -23,6 +23,7 @@ Two ways to say where the artifacts are.
 
 ```
 report_generator generate --scan_id <uuid> [--path <file-or-directory>] --config config.json
+    [--project <name>] [--manufacturer <name>]
 ```
 
 **Out of a folder** — neither Postgres nor the bucket, just the artifacts as the pipeline exported
@@ -30,6 +31,7 @@ them:
 
 ```
 report_generator from-folder --artifacts ./sample [--path <file-or-directory>]
+    [--project <name>] [--manufacturer <name>]
 ```
 
 `--scan_id` is optional there: the pipeline writes its own id into the paths it records in
@@ -96,7 +98,7 @@ vectors by `persistent_storage.utils.cvss_utils`.
 ### What it cannot fill in
 
 A field the artifacts do not answer is written as `<xxx>`, never guessed or quietly dropped. Today
-that is the manufacturer, the analysed lines of code, the language
+that is the manufacturer (unless given with `--manufacturer`), the analysed lines of code, the language
 breakdown, and the tools and profile of each pipeline stage — the metadata records that a stage ran
 and how long it took, not what it ran.