#1493)

* fix(scan): reject every --reach-* modifier when --reach is not enabled

The 'reachability flags require --reach' guard in 'socket scan create'
relied on a hand-maintained list of flags that had drifted out of sync:
--reach-debug, --reach-detailed-analysis-log-file,
--reach-disable-external-tool-checks, and --reach-retain-facts-file were
missing, so passing them without --reach silently produced a plain SBOM
scan that could be mistaken for a reachability scan.

Derive the boolean-flag check from the reachabilityFlags definition
instead, so newly added flags are covered automatically. The deprecated
no-op --reach-disable-analysis-splitting stays exempt.

* refactor(scan): use array destructuring in reach flag check

* upgrading coana to version 15.10.15

* move release notes under Unreleased and drop hand-written version bump

The publish workflow derives the version on v1.x; hand-writing it would
desync the changelog from the released version.

---------

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: Martin Torp <martin@socket.dev>