spec-go-signing-tool: three gaps between the spec and the implemented CLI

[DeepDiver1975]

Found while reviewing owncloud/ocsign#21. All three are spec-side; the
implementation is the more complete artifact in each case.

1. §3.6 does not list the core mode top-level directory exclusions. Core
mode drops the top-level data, themes, config, apps, assets and
lost+found directories wholesale — transcribed from the legacy PHP
ExcludeFoldersByPathFilterIterator so the manifest matches the verifier. §3.6
lists core/signature.json, the cruft, core/js/mimetypelist.js, .htaccess
and .user.ini, but not these six, and they appear nowhere else in the spec.
They are normative — a verifier written from the spec alone would disagree with
ocsign on every real server root. ocsign's README cites §3.6 for them, which
is where a reader would reasonably look.

2. §2 flag list is missing --allow-vcs and --version. Both are
implemented; --allow-vcs also gates a new exit-1 condition that §2's exit code
table should mention (--path is a repository checkout).

3. §3.1 says nothing about resolving a symlinked --path. The rule that a
symlink is never followed is about entries inside the tree. The root itself
must be resolved before the walk, or filepath.WalkDir-style enumeration yields
the link and stops — producing an empty manifest under a perfectly valid
signature. ocsign resolves it; the spec should require it so the verifier does
too.