test: add unit coverage for src/cli/config.ts (#1002)

[chiliec]

What

Adds tests/cli/config.test.ts, the missing unit coverage for src/cli/config.ts requested in #1002.

Closes #1002

Coverage

validateCaCertFile(filePath) — one assertion per failure path plus the happy path:

• missing path → throws /cannot read file/
• a directory → throws /not a file/
• an empty file → throws /file is empty/
• a whitespace-only file → throws /file is empty/ (exercises the content.trim() branch)
• a non-PEM file → throws /not a valid PEM certificate/
• a file starting with -----BEGIN CERTIFICATE----- → does not throw
• a PEM with leading whitespace → does not throw (exercises the trimStart() branch)

getConfigDir() / getConfigPath() — assert they end with .cve-lite-cli and .cve-lite-cli/config.json, and that getConfigPath() lives inside getConfigDir().

Temp files are created with fs.mkdtempSync(path.join(os.tmpdir(), ...)) and removed in a finally block, matching the existing tests/osv-cache.test.ts style. Left readConfig/writeConfig out per the issue's "optional stretch" note (they touch the real home dir).

Validation (Node 20.18.1)

$ npm test tests/cli/config.test.ts
PASS tests/cli/config.test.ts
Tests: 9 passed, 9 total

• npm run build (tsc) — clean, no type errors.
• Test-hygiene gate (pretest) passes: no .only, no Mocha-isms.
• RED→GREEN proof the tests are real: temporarily removing the empty-file and PEM guards from validateCaCertFile makes exactly the three corresponding tests fail; restoring them makes all 9 pass again.

Note: the repo's tests/e2e/* and tests/audit-log/* suites currently fail on a clean main checkout too (they assert on CLI report output / "Override hygiene", unrelated to config.ts) — those failures are pre-existing and outside this diff. This PR only adds one test file and changes no source.

First-time contributor here — happy to adjust naming, split cases, or add the readConfig/writeConfig stretch coverage if you'd like it.