fix(score): replace hardcoded config score with real Dockerfile analysis (closes #44)

[advaitpatel]

Summary

• Replaces the permanently hardcoded configuration score of 75.0 in score_calculator.py with a real _calculate_config_score() method that analyses actual Dockerfile content
• Bumps version from 2026.2.23 → 2026.4.2 for release

What was wrong

Every security score DockSec ever reported was inflated by ~15 points. The 20% configuration weight always contributed a fixed 75 * 0.20 = 15 points regardless of whether the container was running as root, had exposed secrets, used :latest tags, etc.

What the new method checks

Check	Deduction
No USER directive / explicit USER root or USER 0	−25
ENV sets a credential variable (PASSWORD, SECRET, API_KEY, TOKEN, etc.)	−30
Base image uses :latest tag or has no tag	−15
No HEALTHCHECK directive	−10
Sensitive ports exposed (22, 23, 3306, 5432, 27017, 6379, 9200)	−10
ADD used instead of COPY	−5
--privileged flag present	−20

Falls back to Hadolint output signals (DL3002, DL3007) when no Dockerfile path is available (e.g. --image-only mode).

Test results

Bad Dockerfile score:  5.0/100   ✓
Good Dockerfile score: 100.0/100 ✓
Hadolint-only score:   60.0/100  ✓

Existing test suite: 10 passed, 7 pre-existing failures (unrelated to this change).

Test plan

• Run docksec Dockerfile -i myapp:latest against a Dockerfile with no USER, :latest tag, and an exposed ENV PASSWORD=... — config score should be ≤ 30
• Run against a well-hardened Dockerfile with USER, pinned tag, HEALTHCHECK — config score should be 100
• --image-only mode (no Dockerfile): verify no crash, fallback to hadolint signals

🤖 Generated with Claude Code