fix: preserve remote base URLs during linting

[jold-sbab]

Summary

Fixes remote reference resolution when --base is supplied as an HTTP(S) URL.

ResolveBasePathForFile currently converts every explicit base value using
filepath.Abs(). This changes a URL into a local filesystem path, so external
$ref documents are resolved through a different code path.

This change preserves explicit HTTP(S) base URLs while retaining absolute-path
normalization for local base paths.

Validation

• Added regression coverage for explicit HTTP and HTTPS base URLs.
• Ran go test ./cmd.

Reproduction

I used internal YAML files and hosts for exploring this, which I cannot share. Here's the gist of it:

vacuum lint \
  --base https://example.com/specs \
  --ruleset ruleset.yaml \
  openapi.yaml

[daveshanley]

[P2] Preserve remote bases for JSON Schema stdin too

This helper fixes the file-based lint/report paths, but collectSchemaInputs still bypasses it for stdin and unconditionally runs filepath.Abs(baseFlag). That leaves both vacuum schema lint --stdin --base https://… and vacuum schema bundle --stdin --base https://… treating the URL as a local directory. On this head, the bundle path attempted to open /private/tmp/.../http:/127.0.0.1:18765/defs.json, and no request reached the HTTP server.

Please route the stdin base through this helper (or a shared base normalizer) and add regression coverage for schema lint and bundle stdin modes.

[daveshanley]

Review summary

The core file-based fix works as intended. I verified the exact PR head (c0603cb) end to end against a local HTTP server: linting with an explicit remote --base fetched and resolved GET /components.yaml. I also ran GOWORK=off go test ./...; the full Go suite passed. The GitHub Build check is now green.

One P2 remains inline: JSON Schema stdin still sends baseFlag through filepath.Abs, so remote bases remain broken for both schema lint --stdin and schema bundle --stdin.

Suggested next steps:

1. Route the schema stdin base through ResolveBasePathForFile("stdin", baseFlag) or extract a shared URL-or-path normalizer used by every input mode.
2. Add focused regression tests for both schema stdin lint and bundle paths using an httptest server, asserting the remote ref was actually requested and resolved.
3. Consider upgrading the new helper-only test to one end-to-end remote-ref test; asserting the string survives does not prove the motor selects and exercises the remote resolver.
4. Add an accepted release label (bugfix or the appropriate release/* label) to clear the remaining label-check failure.
5. Re-run the checks after the follow-up commit and request re-review of the inline thread.

No other correctness issues found in this change.