[John-David Dalton (jdalton)]

Dependency-source labels now retain npm scopes and Maven groups, so distinct ancestor packages are not shown under the same name.

The namespace is included in package and alert provenance labels and in JSON introduced_by; manifest paths, ordering, and traversal behavior are unchanged.

Builds on #404. Validation: 30 focused tests plus scoped lint/format checks pass.

Preserve package scopes and groups in dependency source labels.

[lelia]

Heads up: #452 carries the same get_source_data change as this PR (keeping the namespace in ancestor labels), because it adds an "Introduced by" line to the default security comment and needed scoped npm and Maven ancestors to render correctly without waiting on the stack.

If #452 lands first, the socketsecurity/core/__init__.py hunk here becomes a no-op on rebase, and this PR could drop it and keep only the JSON/provenance tests. If this stack lands first, I'll resolve the conflict on #452. Either way works, no action needed unless you'd prefer to simplify here.