Use staging API for dependency scan action

[zeyu2001]

Summary

• default the action report client to https://api-staging.hacktron.ai/v1/hfw
• keep the public action fast-mode only with no API key or Cloudflare Access inputs
• fix manifest input parsing so edge whitespace is trimmed without deleting spaces inside paths
• add regression coverage for staging URL construction and manifest path handling

Validation

• uv run --locked ruff format --check .
• uv run --locked ruff check .
• uv run --locked pytest
• uv run --locked python -c "import yaml; yaml.safe_load(open('action.yml'))"
• curl -i -X POST https://api-staging.hacktron.ai/v1/hfw/verdicts/batch?scan_mode=fast ... returned status=done without auth