fix(supply-chain): exclude pyproject metadata keys from dependency extraction

[CharmingGroot]

Fixes #2.

What this fixes

The Supply Chain analyzer (SC4) reported a HIGH "Known Vulnerable Dependency" on the requires-python key of pyproject.toml, matching it to the malicious PyPI advisory MAL-2025-41747 (a real malicious package literally named requires-python).

Root cause: pyproject.toml was parsed with _extract_packages_from_requirements, the requirements.txt line parser. It treats any line beginning with a name as a package, so PEP 621 [project] metadata keys (requires-python, name, version, …) were extracted as package names and looked up in OSV. requires-python appears in essentially every modern Python project, so this produced a false HIGH (and inflated risk scores toward DO_NOT_INSTALL) on almost any pyproject.toml.

Reproduced on v2.1.3 with a vanilla project:

[project]
name = "example"
requires-python = ">=3.12"
dependencies = ["httpx>=0.28"]

[HIGH] Supply Chain | Known Vulnerable Dependency: requires-python — MAL-2025-41747

The fix

Add _extract_packages_from_pyproject (using stdlib tomllib, no new dependency — the project already targets 3.12+) that collects package names only from PEP 621 dependencies / optional-dependencies and PEP 735 dependency-groups, parsing PEP 508 requirement strings. _analyze_dependencies routes pyproject.toml to it; requirements.txt, setup.py, and Pipfile keep the existing extractor, so this change is scoped to the false positive in the issue.

After the fix, requires-python (and other metadata keys) are no longer treated as packages, while real dependencies are still extracted and evaluated.

Testing

• ruff check src/ tests/ and ruff format --check src/ tests/ pass.
• pytest -m 'not integration' passes (607 passed, 11 skipped). The integration suite needs an LLM endpoint and is unaffected.
• Added tests: metadata-key exclusion, optional/group dependency extraction, malformed TOML, no-[project] tables, non-PEP 508 / include-group entries, and that a real vulnerable dependency in pyproject is still flagged (SC4 via static fallback).

[A-KumarSharma]

this is a correct one