[floriankraemer]

Summary

• New options on analyse and churn: --coverage-jacoco, --coverage-cobertura, --coverage-clover (mutually exclusive, file must exist, exit 1).
• Readers per format share an XML loader that never loads external entities or DTDs and caps entity expansion.
• Method line coverage falls back to class coverage; shown as a Line Coverage / Coverage column in console, json, csv, html and markdown only when data is present.
• Churn fills coverage, riskChurn and riskLevel; console and reports get Risk Churn, Coverage and Risk Level columns.
• Custom reporters get a nullable coverage on the method input.
• Coverage is applied after the cache lookup and never stored.

Test plan

• ./mvnw -B verify (unit, E2E, golden files, JaCoCo, PIT incl. new coverage package)
• Real JaCoCo XML fixture generated from a fixture class; Cobertura and Clover fixtures for the same class
• XXE, entity bomb, external DTD, malformed XML, wrong format, exclusivity and missing file cases