Advisories: check argument conditions at the call site #110

Follow-up to #109. An advisory entry point may carry an argument condition (yaml.load(..., Loader=FullLoader) is affected, Loader=SafeLoader is not). The engine records it but does not check it: every condition is listed as pending review.

• CallSite carries the symbol each argument denotes when it denotes one (positional and keyword); cache format bump.
• reachable-vulnerability and the correlation evaluate argument conditions at the site: satisfied → condition dropped from conditions_pending_review; contradicted (a known symbol not in values) → no finding for that entry point; unknown value → stays pending review.
• An absent argument satisfies the condition when the advisory says the vulnerable value is the default ("default": true on the condition).
• Tests on the synthetic advisory of tests/test_advisory_evidence.py: three call sites, three outcomes.