feat: Make comparison metric user-specifiable

[dguido]

Summary

This PR implements user-specifiable comparison metrics to address issue #14, allowing users to control how detections are ranked and filtered.

Changes

New Features

• 6 comparison metrics via new metrics.py module:

  • sum (default): Sum of both similarity scores
  • average: Average of both similarity scores
  • min: Minimum similarity (most conservative)
  • max: Maximum similarity (most aggressive)
  • token_overlap: Raw token overlap count
  • weighted: Weighted combination of similarities and token overlap

• CLI enhancement: Added --metric argument to select comparison metric

• Smart filtering: --min-similarity now works as minimum token count for token_overlap metric

Special Handling for Token Overlap Metric

• Shows raw token counts (e.g., "3568") instead of normalized values (0.2566)
• CSV header displays "Token Overlap" instead of "Similarity"
• JSON output uses "token_overlap": 3568 field
• Filtering by minimum token count (e.g., --min-similarity 1000 means at least 1000 tokens)

Bug Fix

Also includes fix for RepositoryCommit checkout issue discovered during testing (incorrect commit hash passed to parent repository). Fixes #27

Usage Examples

# Use token overlap metric with minimum 1000 tokens
vendetect test_repo source_repo --metric token_overlap --min-similarity 1000

# Use conservative minimum similarity metric
vendetect test_repo source_repo --metric min --min-similarity 0.8

# Use weighted metric for balanced comparison
vendetect test_repo source_repo --metric weighted

Testing

All metrics have been tested and produce different rankings:

• sum, average, min, weighted → prioritize wake/compiler/exceptions.py
• max → prioritizes wake/detectors/template.py
• token_overlap → prioritizes wake/ir/types.py (3568 tokens)

Motivation

This addresses the TODO comment about making the comparison metric user-specifiable and resolves issues with too many false positives from whitespace overlap when using the default metric.

Fixes #14