Apply the external-refs policy in the capture reader

kin-openapi applies IsExternalRefsAllowed only when no custom
ReadFromURIFunc is installed; with one it hands the policy to the reader.
The capture reader that --open installs did not apply it, so
--allow-external-refs=false had no effect on file, URL and glob sources:
a spec could read any local file or reach any URL, and the full bytes of
what it read went into the uploaded review bundle.

Both custom readers now go through one check. The git-revision reader
keeps its own, since an allowed $ref there carries a "<rev>:" prefix
rather than naming a file, and passes no root so that check stands alone.

With external refs disallowed a spec must be self-contained, so only the
document the load was asked for may be read. That is what kin-openapi
refuses on its own: any $ref to another document, a sibling included.

The explanation now sits with the shared check rather than in git.go,
where the reader added later never saw it.

Reported-by: Zachariah Mithani (AploSec)
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017e285CvofYf6joqC98gTXz

Merge pull request #1330 from oasdiff/chore/update-deps

chore: update dependencies, Go 1.27.2, and build the Docker image with Go 1.27

Merge pull request #1259 from oasdiff/chore/claude-config-to-docs

chore: move the repo guide into docs, drop the Claude skills

Merge pull request #1255 from oasdiff/hotfix-cyclic-hang

diff: revert the v1.32.0 cycle handling until #1254 ships

Merge pull request #1232 from oasdiff/bound-increase-decrease

checker: generate the increased and decreased bound rules

Merge pull request #1220 from oasdiff/bound-doc-scope-dispatch

boundDoc dispatches on scope like boundLocation

checker: decide multipleOf generalization on exact rationals (#1205)

Fixes #1187.

isIntegerMultiple tested the ratio of the two bounds against a relative
float tolerance, so a ratio merely close to an integer counted as one:
multipleOf 1.000000001 tightened to 1 reported as a generalization,
claiming every previously valid value remains valid when 1.000000001
itself is rejected under the new bound. A safe verdict resting on a
tolerance is the direction a checker must not err in.

Each value is now read back as the decimal it round-trips to and the
division is exact rational arithmetic, so decimal literals divide the
way their author meant (0.3 over 0.1 is 3, not a float slightly below
it) and a near-integer ratio is not an integer. The tolerance existed
for the first case; the rationals keep it without the second.


Claude-Session: https://claude.ai/code/session_01QDvUFsg5nu1NBWQffErGDw

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>