Config-driven vulnerability suppression leaves no trace in machine-readable output

Manager.Get loads an osv-scanner.toml from each scanned manifest's directory and applies its IgnoredVulns/PackageOverrides ignore directives to that directory's results. During a recursive scan this can reach directories the person running the scan didn't author (vendored deps, submodules, extracted archives, a folder added by a PR). A config placed there suppresses findings silently — currently only logged at info level, so under --verbosity warn or JSON/SARIF output the scan can print "no issues found" / exit 0 with no trace that anything was suppressed.

Proposal:

• Raise config-driven suppression logging to warning level (loaded config path, each suppressed vuln/package, filtered count).
• Add a --no-config-ignore flag that drops suppressing directives (IgnoredVulns, ignore flags on PackageOverrides) from auto-discovered configs, while leaving license overrides intact. Configs passed explicitly via --config stay trusted/unaffected.

Happy to submit a PR for this once discussed/assigned — closing #2997 per contributing guide since it was opened without an issue first.