Adds optional block_on_threat (default True) and min_severity (default HIGH)
inputs to TensorTrapAnalyzeWorkflow, matching the API already in place on
TensorTrapScanModel.
When the node finds a finding at or above min_severity, it raises with a
message naming the offending node and pointing at the override knobs.
Workflows can now stop a CWE-502 payload before any other node runs, instead
of just reporting after the fact.
Also includes the reference URL in the report output when a finding carries
one (e.g., RES4LYF#252 link on pickle-deserialization findings).
Tests cover all four corners of the block_on_threat x severity matrix plus
the clean-workflow and prompt=None paths.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
