fix(plugin): separate diff revisions from paths in scan inputs

[WenJing95]

Summary

run_git_changed_paths runs git diff --raw without --, so Git also tries the revision args as paths. A local patch scan with --base release fails if there's also a release/ directory, and on Windows a <sha>..<sha> range fails with "Filename too long" in deep repo paths.

Changes

Added -- after the revision args, like workbench_target.py does. Added a test with a base branch named the same as a directory.

Testing

Tests pass.

Risk and rollout

Callers only pass revisions and --cached, so the selected changes stay the same.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.