Improve advisory ignore matching and stale ignore warnings

[ericmj]

Follow-ups from review of #1198.

• Ignore matching now suppresses whole aliased advisory groups. Matching previously ran per raw advisory on its own id/aliases, but the audit displays merged groups, so ignoring the displayed primary ID (e.g. an EEF ID) only suppressed the sibling GHSA/NVD advisories if they cross-referenced that ID in their aliases — otherwise the same vulnerability showed under both Advisories: and Ignored advisories: and the audit still failed. Ignoring any identifier of a display group now suppresses all of its members, in both mix hex.audit and mix deps.get, and the audit partitions advisories in a single pass instead of two.
• Stale ignore warnings now name where the entry is set (mix.exs, environment variable, or global config), since a globally-set entry would otherwise produce "can be removed" advice in every project, and are separated from the findings sections by a blank line.