Use server-provided scan report links

[John-David Dalton (jdalton)]

LLM Description written by Codex:GPT-6

Use the report links returned by Socket so Python CLI results point to the correct comparison and scans, including alternate deployments.

Root Cause

The CLI built dashboard URLs from scan IDs instead of preserving the API response. Appending query strings also broke links that already had query parameters or fragments.

Fix

• Keep server-provided comparison and full-scan URLs through primary and fallback results.
• Match nested scan IDs before attaching their URLs; preserve absent links without inventing routes.
• Add query options without losing existing parameters or fragments.
• Omit unavailable Jira and Slack links.

Builds on #398; merge after its parent. This PR does not change output schemas or publish a release.

Validation and limits

All 36 focused pure and real local HTTP tests pass. Scoped Ruff passes. Pytest reports two pre-existing unknown asyncio configuration warnings. The tests exercise the real CLI core and SDK. The streaming SDK does not expose the old and new scan URLs; known scan-creation URLs are retained where available.

Public Changelog

Use server-provided report links and preserve their query parameters in Python CLI output.

---

Note

Medium Risk
Changes how every user-facing report URL is built across diff, full-scan, and notification paths; incorrect handling could break CI links or point to wrong reports, but does not touch auth or scan data.

Overview
Report links now come from the Socket API instead of hard-coded socket.dev/dashboard/org/.../sbom/{id} URLs, so CLI output works with alternate deployments and the links the server actually serves.

Diff and full-scan flows populate diff_url, old_scan_url, and new_scan_url on Diff (and on comparison result types) from polled diff-scan html_url / nested full-scan metadata, with ID checks before trusting nested scan URLs. Streaming diff fallback keeps diff_report_url from the SDK. include_license_details=false is applied via a new add_query_params helper so existing query strings and fragments are preserved.

PR comments, manifest file links, Slack, and Jira now use Messages.get_view_report_url and omit links when URLs are missing. Tests cover URL normalization, query merging, and end-to-end diff URL behavior.

^{Reviewed by Cursor Bugbot for commit b8b6d48. Configure here.}