feat: Add --exclude flag to factor validate

[cutzpatr]

Summary

Add ability to exclude directories from factor validate scans to reduce false positives.

Problem

When running factor validate on real-world codebases, certain directories produce false positives:

• legacy/ - archived code kept for reference
• actions-runner/ - CI runner with test credentials
• third_party/ - vendored dependencies
• examples/ - sample code with hardcoded values for demonstration

Proposed Solution

Add --exclude / -e flag that can be specified multiple times:

factor validate -p /path/to/app -e legacy -e actions-runner

Alternative

Expand the built-in skip_dirs list in is_hidden_or_vendor() to include common false-positive directories.

Workaround

Currently using factor validate -f json | jq to filter results externally.