Fix unreachable and ineffective --from-json input validation

[0Cymantek0]

Fixes #5351

In validate_input_path() the --from-json checks never ran: options.get("--from-json") always returned False because click keys ctx.params with the option name "from_json", and the extension and header checks were dead code after an unconditional raise inside a "not is_file()" condition. Bad inputs were only caught late at codebase loading, with the raw file content dumped in the error (e.g. the full PNG bytes for png.png).

Changes:

• Query the option as "from_json" and run the checks upfront: --from-json inputs must be readable files with a .json extension starting with "{".
• Read the header sniff in binary mode so binary files get a clean error instead of a UnicodeDecodeError.
• Keep the late "Input JSON scan file(s) is not valid JSON" handler for files that pass the sniff but fail full parsing, e.g. truncated JSON.
• Update the faulty_json test expectations and add regression tests for early validation and directory inputs. Scan files without a .json extension are now rejected upfront, as intended in the original 548b4b3 validation.

Validation:

• pytest tests/scancode/test_cli.py -k "from_json or validate_input or merge_multiple or VirtualCodebase" : 12 passed
• Full standard suite before the fix: 66 failed / 3861 passed; after: 51 failed / 3878 passed, all remaining failures pre-existing on this windows machine.

Tasks

• Reviewed contribution guidelines
• PR is descriptively titled 📑 and links the original issue above 🔗
• Tests pass -- look for a green checkbox ✔️ a few minutes after opening your PR
  Run tests locally to check for errors.
• Commits are in uniquely-named feature branch and has no merge conflicts 📁
• Updated documentation pages (if applicable)
• Updated CHANGELOG.rst (if applicable)