Add version-to-version risk and permission diff tracking for rescanned extensions

[Meghraj-100]

Description

ExtensionShield evaluates extensions at a single point in time. The database (src/extension_shield/api/database.py) stores scan results and the manifest parser extracts version information, but there is no mechanism to compare risk scores or permission sets between successive scans of the same extension.

This leaves a blind spot for supply chain compromise via extension updates:

1. Developer publishes a safe extension, accumulates a large user base
2. A subsequent update introduces dangerous permissions and data exfiltration code
3. Users receive the update automatically and are compromised

Problem

• No version-to-version comparison of risk scores or permissions
• An extension can go from "Safe" (score 85) to "Unsafe" (score 35) after an update with no historical context shown
• Cannot detect newly added dangerous permissions between versions

Expected Behavior

• Re-scanning an extension should compare results with the most recent previous scan
• Significant score drops or newly added dangerous permissions should trigger alerts
• Users should be able to see a risk timeline showing score progression across versions

[Stanzin7]

@Meghraj-100 the product does not currently provide full version-to-version comparison, permission diffs, or a real user-facing risk timeline across extension updates. we also do not keep a full historical record of every scanned version in scan_results; the current storage model is mainly latest-state per extension_id.

What is not fully true:
It is not correct to say there is “no mechanism” at all. The code already extracts version information, and the database layer keeps some limited previous-scan metadata such as first_scanned_at, previous_scanned_at, and previous_scan_state. So there is already partial support for comparing the current scan to the immediately previous one, but not a full history or full diff system.

This is a feature gap, not a critical bug. The missing piece is full historical scan/version tracking and clear comparison of score, permissions, and findings across updates.

[Meghraj-100]

@Stanzin7 Thanks for the clarification! I accidentally closed this issue earlier. I can work on a proposed design or partial implementation for version-based tracking and comparison. Please let me know if you'd prefer a design proposal or a PR draft. Happy to contribute further!