Correctly calculate statistics when running scans

[egibs]

Addresses #648

Running a scan would drop any file report whose risk was < HIGH. This threw off --stats since we'd only calculate the percentage of critical and high risks from the number of file reports matching those severities.

This PR tweaks the report and statistics logic so that we have the same number of files that analyze would have.

Example:

$ go run cmd/mal/mal.go --stats scan ./out/chainguard-dev/malcontent-samples/python/
...
📊 Statistics
---
Files Scanned   89 (48 skipped)
Total Risks     41
---
⚠️  Risk Level Percentage
---
Risk Level    Percentage Count/Total
4/CRIT            39.33% 35/89
3/HIGH             6.74% 6/89
---
Number of behaviors         72
...

Files Scanned matches what analyze sees:

$ go run cmd/mal/mal.go --stats analyze ./out/chainguard-dev/malcontent-samples/python/
📊 Statistics
---
Files Scanned   89 (0 skipped)
Total Risks     89
---
⚠️  Risk Level Percentage
---
Risk Level    Percentage Count/Total
2/MED             44.94% 40/89
4/CRIT            39.33% 35/89
1/LOW              8.99% 8/89
3/HIGH             6.74% 6/89
---
Number of behaviors        962
...

[egibs]

Left this here for future use.