fix: XLSX response_time variable collision, folderoutput support, and notify counter

[matthew6s]

Summary

Fixes three bugs found during code review:

Bug 1: XLSX response_time_s variable collision (sherlock.py:913)

response_time_s is initialized as [] on line 903, then checked
with is None on line 913. A list is never None, so the condition
is dead code — None query times get appended as-is instead of
being converted to empty strings.

This matches the pattern already used in CSV output (line 882-884).

Bug 2: XLSX ignores --folderoutput flag (sherlock.py:935)

CSV output correctly respects --folderoutput (lines 856-859),
but XLSX always writes to the current directory. Added the same
folder handling logic.

Bug 3: Global mutable counter in notify.py

globvar is a module-level global that persists across multiple
username scans. Combined with finish() calling countResults()
(which increments) then subtracting 1, the reported count can be
wrong on multi-username runs. Replaced with an instance variable
on QueryNotifyPrint.