Remove obsolete --call-graph-provider both from TypeScript backend; add a configurable tsc_only toggle

[rahlk]

Summary

The TypeScript backend (TSCodeanalyzer) shells out to the packaged
codeanalyzer-typescript (cants) binary. That binary exposes a
--call-graph-provider <tsc|jelly|both> option (default tsc). The both
(and jelly) provider machinery is obsolete — the resolver-based tsc
provider is the only supported path going forward.

Today the SDK never passes --call-graph-provider, so it implicitly rides on
the binary default. We should make our intent explicit and stop depending on
the obsolete both provider.

Findings

• cldk/analysis/typescript/codeanalyzer/codeanalyzer.py builds the binary
  args from -i, -a, -o, -t only — --call-graph-provider is never
  passed (verified: the string appears nowhere in the repo).
• cants --help (codeanalyzer-typescript 0.4.1) still advertises
  --call-graph-provider <name> call-graph backend: tsc (default) | jelly | both.
• pyproject.toml pins codeanalyzer-typescript==0.4.0; latest on PyPI is
  0.4.1.

Proposed work

1. Treat --call-graph-provider both as obsolete — do not expose or rely on it
   from the SDK.
2. Pin codeanalyzer-typescript to the latest PyPI release (0.4.1).
3. Surface a configurable tsc_only toggle (default False) on the TypeScript
   codeanalyzer config. When enabled, the backend pins the provider to the
   resolver path (--call-graph-provider tsc) instead of the obsolete both.

[rahlk]

Update on item 3: --tsc-only lands as a first-class flag in codeanalyzer-typescript 0.4.2, so the tsc_only toggle on TSCodeAnalyzerConfig now emits --tsc-only directly (preempting the release) rather than --call-graph-provider tsc. Note: tsc_only=True therefore requires the analyzer binary >= 0.4.2; the default (False) keeps working on the currently pinned 0.4.1.