[SizzleUnrlsd]

Item 1 of #21: the library API called from C++, and a project consuming the library the way ctrace will (CoreTrace/coretrace#112).

Change

1. api_unit (unittests/api_test.cpp): Run and RunBatch on real programs, compiled with coretrace-compiler and executed. The heap overflow fixture gives one finding with its rule, CWE, severity, message, faulting line and column, and allocation site in the same source. A compile-only run succeeds without executing and leaves the binary at output_path. A hanging program is killed after the 1 s timeout, reported timed_out and not a success, within seconds. A batch of three sources (hang, overflow, clean) reports them in path order with each one's result, timeouts=1, no compile failure, success and verdict 2. Compile-only flags with a run are refused with a diagnostic naming --no-run. An empty directory is not analyzed and says so.
2. consumer: unittests/consumer/ is a complete consumer, FetchContent_Declare on the release tag and coretrace::runtime-analyzer_lib, whose main analyzes a program and prints its findings. The test configures it with the same generator, compilers and LLVM as this build, points FETCHCONTENT_SOURCE_DIR_RUNTIME_ANALYZER at the checkout under test and the CC and CORETRACE_LOGGER ones at the sources already fetched here (nothing is cloned), builds it and expects heap-buffer-overflow CWE-122 on heap_overflow_write.c. It lives under unittests/, not test/, which the sweeps run in full.
3. build: require C++20 of the library's consumers: the first run of the consumer test failed to include runtime_analyzer.hpp (no template named 'optional' in namespace 'std'), because the C++ standard was set for this project's targets only. cxx_std_20 is now a public compile feature of the library. ctrace would have hit this on its first build.
4. README: the two tests in the table, and the consumer named in "Library Use".

Tests (written first)

Both tests are the deliverable. api_unit failed on its first run on my prediction of the location's path (the runtime names the source as coretrace-compiler recorded it, which can be relative; the test checks the tail of the path and that the allocation site is in the same source). consumer failed on the C++20 requirement, item 3 fixed it. With ParseFindings disabled in Run, both fail again: 2 checks in api_unit, the grep in consumer.

Verification

• macOS arm64: ctest --test-dir build 14/14, consumer in 10 to 18 s; ./scripts/format-check.sh clean.
• Linux: this pull request's Build workflow.