fix: Reject symbolic links as scan target or project root

[danskmt]

What does this PR do?

determineAnalyzeInput now uses os.Lstat instead of os.Stat and rejects any path that is a symbolic link with a clear error message ("path is a symbolic link; pass the real path instead"). This covers both a symlink file target and a symlinked project root, replacing the cryptic SNYK-CODE-0006 error for the latter case.

Where should the reviewer start?

internal/commands/code_workflow/native_workflow.go — the determineAnalyzeInput function.

How should this be manually tested?

1. Create a symlink to a directory: ln -s /some/real/repo repolink
2. Run snyk code test repolink — should fail with a clear symlink error instead of SNYK-CODE-0006.
3. Create a symlink to a file: ln -s /some/real/repo/file.js link.js
4. Run snyk code test link.js — should fail with the same symlink error instead of scanning the target.

Checklist

• Tests added and all succeed
• Linted
• README.md updated, if user-facing

🚨After having merged, please update the snyk-ls and CLI go.mod to pull in latest client.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.