Match equivalent findings across Standard and Deep scans

Standard and Deep scans of the same repository revision can assign different identity.anchor values to the same vulnerability. Consequently, scans compare may report the previous finding as unknown and the equivalent new finding as newly introduced.

Reproduction: run both scan modes against the same synthetic vulnerable repository, then compare their results.

Expected: equivalent findings with matching vulnerability families and source locations remain identifiable across scan modes.