Upgrade scandal to handle file read errors

Right now, if find-and-replace / scandal encounters a bogus or unreadable file, it just doesnt finish. No good. This bubbles errors up from the new scandal to the consumer of the `project.scan` and `project.replace`.

One thing I need help with is testing this. Testing the replace is easy as we pass in a list of paths. So I can just pass a bogus path in there. Testing `project.scan` is harder because it wont try to open any files that dont exist, and I dont know how to reliably (across machines) get it to scan a file the test user cant access. If you have ideas, let me know.