Add --re-enrich flag to reprocess existing DB entries with current code

The old --existing-db flag skipped already-enriched entries by advisory
ID, so improvements to diff_analyzer.rs had no effect on the committed
vuln_db.json. The new --re-enrich flag re-fetches diffs for existing
entries and re-extracts symbols using the current code, updating them
in-place.

The CI enrich job now passes --re-enrich so that code changes to the
symbol extraction pipeline are reflected in the PR's vuln_db.json diff.

https://claude.ai/code/session_01P1LKP6aqGt68rQAXrF6kSE

.github/workflows/ci.yml

@@ -62,19 +62,15 @@ jobs:
       - name: Build
         run: cargo build --release
 
-      - name: Run enrichment pipeline
+      - name: Re-enrich vuln_db.json with updated code
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          EXISTING_FLAG=""
-          if [ -f vuln_db.json ]; then
-            EXISTING_FLAG="--existing-db vuln_db.json"
-          fi
-
           cargo run --release -- enrich \
-            --limit 20 \
+            --existing-db vuln_db.json \
+            --re-enrich \
+            --limit 999999 \
             --timeout-secs 1500 \
-            $EXISTING_FLAG \
             --output vuln_db.json
 
       - name: Commit updated vuln_db.json if changed