fix(plugin): use the SHA-256 empty tree for root commit diffs - #1716

Summary

For a root commit, require_diff_target uses EMPTY_GIT_TREE as the base, which is the SHA-1 empty tree. SHA-256 repos don't have that object, so diff scans of a root commit fail with "unknown revision".

Changes

Added EMPTY_GIT_TREES with both the SHA-1 and SHA-256 IDs, picked via git rev-parse --show-object-format. Added a test with a SHA-256 root commit. Same fix as in closed #449, pulled out on its own.

Testing

Tests pass.

Risk and rollout

SHA-1 repos get the same base as before. Needs Git 2.25+ for --show-object-format.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.