chore: modernize Go to 1.25 idioms

[ajayk]

Summary

Apply modern Go idioms across the codebase to match the declared Go 1.25 toolchain.

• Go 1.25: sync.WaitGroup.Add(1) + defer wg.Done() → wg.Go(...) in internal/scanner/scanner.go
• Go 1.24: range strings.Split(...) → range strings.SplitSeq(...) in cmd/bumblebee/main.go
• Go 1.23: manual map copy loop → maps.Copy in internal/ecosystem/mcp/mcp.go
• Go 1.22: for i := 0; i < N; i++ → for i := range N where the loop var isn't mutated (internal/scanner, internal/output/httpsink_test.go, mcp, pnpm, rubygems)
• Go 1.21: manual contains loop → slices.Contains (mcp)
• Go 1.20: HasPrefix+TrimPrefix → strings.CutPrefix; HasSuffix+TrimSuffix → strings.CutSuffix (mcp, pnpm)
• Go 1.18: map[string]interface{} → map[string]any (mcp)
• Go 1.13: err == io.EOF → errors.Is(err, io.EOF) (pypi)

No behavior changes. Loops that mutate i mid-body (docker/npx arg parsers) were intentionally left as classic for-loops since for i := range N doesn't honor in-body increments.

Test plan

• go build ./...
• go vet ./...
• go test ./... — all packages pass