fix: incompatible flag errors should explain which option to use, not just state the conflict

[sonukapoor]

Problem

When incompatible flags are combined, the error only states the conflict:

Error: --fix cannot be used with --json
Error: --offline/--offline-db cannot be used with --osv-url
Error: --no-cache cannot be used with --offline or --offline-db

Users — especially in CI — don't know which flag to remove or why the combination is invalid.

Expected behaviour

Each conflict message should briefly explain the intent of each flag and guide the user:

Error: --fix cannot be used with --json. Use --fix to apply fixes interactively, or --json to output scan results as JSON — not both at once.
Error: --offline/--offline-db cannot be used with --osv-url. Choose offline mode (local DB) or online mode (custom OSV endpoint), not both.
Error: --no-cache cannot be used with --offline or --offline-db. In offline mode the local advisory DB is used directly; --no-cache only applies to online scans.

Where to look

src/index.ts — the flag-incompatibility throw statements around lines 108–128.

Acceptance criteria

• All three conflict errors include a short explanation of what to do instead
• No existing behaviour changes
• Tests updated to assert the new message text

[dagangtj]

PR submitted: #405

All three flag incompatibility errors now include clear explanations:

• --fix vs --json: explains interactive fixes vs JSON output
• --offline/--offline-db vs --osv-url: explains local DB vs custom endpoint
• --no-cache vs --offline: explains cache behavior in offline mode
• --report vs --json: explains HTML report vs JSON output

Ready for review!