fix(general): skip scanning VCS configuration if only files are passed in

[gruebel]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

• currently we scan any json file passed in via -f flag vor VCS configuration, which we shouldn't do 😄

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules