refactor: improve logging in console for macaron commands

[Demolus13]

Summary

Refactor console logging to provide a clearer, more user‑friendly command output with an optional Rich UI output, while keeping detailed logs. Adds a flag to disable Rich output for default plain text UI.

This PR introduces a custom logger built using Rich UI components and the RichHandler to visually enhance terminal logging. The logger can be imported and used across the codebase, offering function calls that allow modification of what is displayed in the terminal. Whenever data is updated through any of these function calls, the make_layout() function in console.py is triggered to rebuild the layout. This function runs every 0.1 seconds, ensuring the terminal display is continuously refreshed to reflect the latest state of the application.

Description of changes

• Introduces a Rich-based logging handler and integrated it into the macaron commands so users see concise, structured progress and results in the terminal.
• Adds a new CLI flag --disable-rich-output to fall back to standard logging formats.
• Improves consistency of log message formatting and argument handling across modules through verbose mode.
• Using Rich Handler to provide a custom logger with rich output to python logging.
• Providing various functions and API calls to update the contents shown on running macaron commands.
• Creating AccessHandler to set logger with verbosity and get logger.
• No functional behaviour changes to analysis/policy evaluation

Modified files

• src/macaron/__main__.py: core logging setup, CLI flag, command dispatch hooks into Rich handler.
• src/macaron/console.py: adds/accesses the Rich logging handler module.
• src/macaron/slsa_analyzer/analyzer.py: logging refinements for analyze command.
• src/macaron/policy_engine/policy_engine.py: logging refinements for verify-policy command.
• src/macaron/repo_finder/repo_finder.py: logging refinements for find-source command.
• src/macaron/config/defaults.py: logging refinements for dump-defaults command.
• src/macaron/output_reporter/reporter.py: small logging/formatting tweaks.
• src/macaron/policy_engine/results.py: small logging/formatting tweaks.
• src/macaron/repo_finder/repo_utils.py: small logging/formatting tweaks.
• src/macaron/policy_engine/base_check.py: log formatting consistency.
• src/macaron/policy_engine/registry.py: log formatting consistency.

Related issues

• Command Line Interface #211

Checklist

• I have reviewed the contribution guide.
• My PR title and commits follow the Conventional Commits convention.
• My commits include the "Signed-off-by" line.
• I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
• I have updated the relevant documentation, if applicable.
• I have tested my changes and verified they work as expected.

[oracle-contributor-agreement]

Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
The following contributors of this PR have not signed the OCA:

• pgovale@parths-macbook-pro.local

To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application.

When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated.

If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public.

[behnazh-w]

@Demolus13 Please add rich as a direct dependency to pyproject.toml.

[behnazh-w]

Please add the new --disable-rich-output command to the Sphinx docs:

• https://github.com/oracle/macaron/blob/main/docs/source/pages/cli_usage/index.rst

[behnazh-w]

Please add a comment above this line to explain what the access_handler.get_handler() does and why it should be called here.

[behnazh-w]

Please also add the following to helps users decode the VSA:

To decode and inspect the payload, run cat output/vsa.intoto.jsonl | jq -r '.payload' | base64 -d | jq.

[behnazh-w]

The output/vsa.intoto.jsonl directory should not be hardcoded, and instead read from vsa_path. It would also be nicer to have a row where the first column is something like Decode and Inspect the Content:.

[behnazh-w]

Suggested change

	# To get the console handler which was set earlier
	# Retrieve the console handler previously configured via the access_handler.
	# This handler is used to format and display output in the console using the
	# 'rich' library for enhanced styling and readability.

I think the rest of the # To get the console handler which was set earlier comments can be removed as they are redundant.