Split the remaining large files by what they hold

[tauanbinato]

Follow-up to #37: the other large files a blind labeler judged worth splitting, plus the 1,811-line security test file, split by what each part holds.

Before	After
analysis/clones.rs (1,909)	clones/mod.rs 838: the matching core apart.rs 170: copies never compared (example, benchmark and retired directories, deprecated code, Bend 2 tests pinned to their output) frame.rs 261: the frame of a tree walk tests.rs 650
units/security.rs (1,189)	security/mod.rs 675: planning, traces, rechecks, confirms subject.rs 242: what a unit is judged on settle.rs 287: the settle catalog
units/questions/security.rs (857)	questions/security/mod.rs 546: first-pass questions and checks confirm.rs 176: the Choices asked after a finding django.rs 149: Django's own checks
units/test_units.rs (818)	test_units/mod.rs 375: value tests setup.rs 282: the setup a test runs, read from its file pairs.rs 178: redundant pairs
units/tests/security.rs (1,811)	tests/security/mod.rs 539: traces, callers, settles plus php.rs 271, kinds.rs 216, exposure.rs 266, settings.rs 256, templates.rs 113, confirms.rs 181

These are pure moves, one commit per file.

• Moved private items are pub(super).
• Items that were pub(super) keep their reach as pub(in crate::units).
• Re-exports keep every outside path working: clones::example_code, security::SETTLES, questions::injection_values and so on.
• Three methods of Subject and the two fields of the test harness's Recording are opened to their module.
• Each module doc names its parts.

Checked:

• Every item of the five files is identical to main's once visibility, crate:: paths and formatting are normalized (compared mechanically). clones.rs's test module moved unchanged.
• The same 487 tests, by name, pass before and after.
• Clippy (also 1.98) and cargo +1.90.0 check --locked pass.
• The self-check with the default gate (it fails on review) exits 0, with no review or consider.
• Corpus, 181 projects from the cache: the 0.24.0 release and this branch, run back to back under one pinned token calibration, give identical reports: 1,655 reviews, 4,406 considers, 29,090 notes and 3,656 undecided units in both. The branch sent no request that 0.24.0 had not already sent.

Not split: file_kind.rs, test_map.rs, transport.rs, docs/load.rs and analysis/comments.rs, which the labeler found fine as they are. analysis/units/mod.rs and analysis/sites.rs are left too; the labeler called them debatable.