chore: bump go-FuSa pin to v0.48.0 across ci.yml + release.yml

[SoundMatt]

Summary

go-FuSa v0.48.0 (upstream go-FuSa#89) fixes a critical bug in
hara.DetermineASIL: the hand-written ISO 26262-3:2018 Table 4 lookup was
wrong in 8/12 S2 cells and 11/12 S3 cells, always inflating the ASIL
rating versus the standard's correct additive S+E+C model
(points = S(1-3) + E(1-4) + C(1-3), <=6 -> QM, 7 -> A, 8 -> B, 9 -> C, 10 -> D, ASIL D only at S3+E4+C3). It also fixes a non-reproducible
qualify.computeHash (hashed the live timestamp, didn't sort results
before hashing), a git argument-injection risk in impact.changedFiles,
and CI SARIF self-scan masking; a stale committed check-report.json was
removed upstream and a legacy .fusa.json shape normalized.

• Bump all three pin locations to v0.48.0: ci.yml's gofusa job,
  ci.yml's compliance job, and release.yml — kept identical per this
  repo's established convention (chore: bump go-FuSa pin to v0.47.1 #61).

Verification

Installed gofusa v0.48.0 locally and ran the exact CI gating sequence
against go-LIN's own tree:

• gofusa check ./..., trace -req-coverage 100, cyber, vuln,
  trace -sec-tested 100, cyber, vuln, qualify, verify,
  coverage, hara show, boundary/sci/coupling/tara/
  fmea -cyber -strict, release, audit-pack (the gofusa job) — all
  clean.
• safety-case, check --output json, all 7 standards gap reports
  (iso26262, iec61508, iso21434, iec62443, do178, unece,
  slsa), and the negative-count JSON sanity backstop (the compliance
  job) — all clean.

No new ERROR/GAP/FAIL findings versus v0.47.1. Specifically:

• go-LIN's own dogfooded .fusa-hara.json (H-01..H-06) was already
  re-derived under the correct additive ASIL model back in fix: audit pass 2 — diagnostic-frame checksum + 8 more findings #72, so the
  upstream DetermineASIL fix surfaces no drift here — gofusa hara show
  reports the same ASIL-A/QM classifications as before (e.g. H-01:
  S2+E3+C2=7 -> ASIL-A; H-05: S1+E3+C2=6 -> QM), with only the
  pre-existing fssrRefs advisories in Gaps.
• gofusa cyber still reports the same 28 pre-existing CYBER009 INFO
  findings (0 error / 0 warning) already documented in ci.yml's
  comments.
• gofusa qualify still passes 46/46.
• gofusa fmea -cyber -strict still clears the content-quality gate.
• iec62443/slsa show a builder-field GAP when run outside CI, but
  that's expected: the field is injected by ci.yml's post-release
  Python step using GITHUB_* env vars, which only runs in Actions.
  Simulating that step locally makes both pass with 0 GAP.

Also ran go build ./..., go vet ./..., go test ./..., and
go test ./... -race — all green.

Per this repo's established convention for pure gofusa-pin bumps (#48,
#56, #61 — none of which carried a version bump or CHANGELOG entry since
no source/spec-facing behavior changed), this PR does not bump go-LIN's
own version.

Test plan

• go build ./...
• go vet ./...
• go test ./...
• go test ./... -race
• gofusa full lifecycle gate sequence (local, v0.48.0) — matches CI
• compliance job's standards gap reports (local, v0.48.0) — matches CI
• CI green on this PR