CM-68709: Add pip package manager support to SCA local scans

[valeriistryhun-dev]

What & why

Enables cycode scan -t sca to support plain pip projects (via pyproject.toml or requirements.txt) during local SCA scans, so CLI users get the same coverage as platform scans. Closes the CLI portion of Pip Phase 1 (CM-68709).

Pip is now a first-class package manager alongside Poetry and uv for pyproject.toml projects, and a standalone handler for requirements.txt — the implementation mirrors the existing Poetry/uv restore handlers.

Changes

• New RestorePipDependencies handler — detects a plain-pip project two ways:
  • pyproject.toml with neither [tool.poetry] nor [tool.uv] (same disambiguation rule the backend's own Poetry/uv restorers use).
  • Any requirements.txt (no content check needed — nothing else claims that filename).
  • If a sibling pylock.toml already exists next to the manifest, it's read directly; otherwise pip lock . (pyproject.toml) or pip lock -r requirements.txt -o pylock.toml (requirements.txt) is run to generate it (then cleaned up).
• Registration — added after RestoreUvDependencies/RestorePoetryDependencies in the restore handler chain, so pip never wins the pyproject.toml race against Poetry/uv.
• consts.py — pylock.toml added to the SCA supported files; a new pypi_pip ecosystem bucket added, and pylock.toml appended to the existing pypi_requirements bucket so diff-scans fetch the lock sibling for the requirements.txt case.
• Tests — unit coverage for detection (plain-pip vs. Poetry vs. uv vs. empty content), command dispatch per manifest type, direct-read of an existing lockfile for both manifest types, and generated-lockfile cleanup.

Acceptance criteria

• ✅ Plain-pip project detected via pyproject.toml (no Poetry/uv sections) or requirements.txt → pip lock restores deps before scanning
• ✅ Pip recognized alongside Poetry / uv for pyproject.toml, without disturbing their existing detection
• ✅ An existing pylock.toml sibling is read directly rather than regenerated
• ✅ Unit tests cover the pip restore flow for both manifest types

Testing

• Full SCA test suite passes (200 tests, incl. 16 new for pip); no regressions in Poetry/uv/Pipenv detection.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.