chore(deps): bump socketdev to 3.6.0

Unblocks the pin now that 3.6.0 is on PyPI. SocketPURL_Type gained ten
members -- alpm, chrome, clawhub, edge-extension, firefox-extension, qpkg,
socket, swid, vscode and vscode-extension -- and removed none, so artifacts
of those types stop falling back to "unknown".

No other CLI change is needed: none of the SDK's enum types are imported
here, and every severity and type lookup already has a default, so the new
members cannot reach an unguarded branch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

CHANGELOG.md

@@ -9,6 +9,14 @@
 - Clarified monorepo scan scoping, workspace flags, CI path filters, and timeout
   behavior, with a changed-workspace GitHub Actions example.
 
+### Changed: bump socketdev to 3.6.0
+
+- Bumped the pinned SDK (`socketdev`) from `3.5.0` to `3.6.0`. Its package-type
+  enum gained ten members — `alpm`, `chrome`, `clawhub`, `edge-extension`,
+  `firefox-extension`, `qpkg`, `socket`, `swid`, `vscode` and
+  `vscode-extension` — so artifacts of those types are now reported under their
+  own type instead of falling back to `unknown`.
+
 ### Fixed: apply configured exit codes to API failures
 
 - Full-scan and streamed-diff API failures now use the configured infrastructure

pyproject.toml

@@ -16,7 +16,7 @@ dependencies = [
     "GitPython==3.1.59",
     "packaging==26.3",
     "python-dotenv==1.2.3",
-    "socketdev==3.5.0",
+    "socketdev==3.6.0",
     "beautifulsoup4==4.15.0",
     "markdown==3.10.3",
     "brotli==1.2.0; platform_python_implementation == 'CPython'",