feat: `scanUrl` dedupe logic and flag for cache/in-flight requests only

[imblue-dabadee]

Explanation

This introduces deduplication logic for scanUrl so that multiple callers do not create multiple in-flight requests for the same URL. It also introduces a flag to only return resolved scans within the cache OR return promises for in-flight requests s.t. it does not create new outbound requests.

Checklist

• [x] I've updated the test suite for new or updated code as appropriate
• [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• [x] I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
• [x] I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes