Stabilize GitLab report serialization and workspace baselines

[lelia]

Summary

• normalize full-scan package identities and links when the SDK returns enum-backed ecosystem types and namespaced packages
• emit GitLab dependency-scanning CVE and GHSA identifiers from current API payload fields while retaining legacy compatibility
• resolve implicit diff baselines from the same workspace, scan type, repository, and default branch
• bump the CLI version to 2.8.1

Why these belong together

These failures occur at the boundaries between Socket API data and GitLab-facing output. Keeping the normalization and baseline rules together gives the integration one consistent compatibility layer instead of addressing each customer symptom independently.

Testing

• 527 passed, 2 skipped
• Ruff passed for all changed implementation and test files

---

Refs: CE-435, CE-438, CE-441