Add --fail-on flag for CI severity filtering

[Jasonleonardvolk]

Add a --fail-on flag that controls which severity levels cause a non-zero exit code.

sigma-guard verify graph.json --fail-on critical # exit 1 only for CRITICAL
sigma-guard verify graph.json --fail-on moderate # exit 1 for MODERATE and above
sigma-guard verify graph.json --fail-on any # exit 1 for any contradiction (default)

This makes CI integration more flexible.