feat(plugins): backfill explicit capabilities for granular denial #1813

[NaitikVerma6776]

Summary

• Backfills explicit capabilities declarations for 52 bundled plugins that previously relied on safety-level implication.
• Enables granular operator denial (e.g. deny network without blocking filesystem-only scanners like code_analyzer).
• Adds scripts/backfill_plugin_capabilities.py and a regression test ensuring every shipped plugin declares capabilities.

Closes #1813

Capability highlights

• Network-only recon: amass, httpx, nmap, whois_lookup, etc.
• Filesystem-only analysis: code_analyzer, secret_scanner, semgrep_scanner, iac_scanner
• Docker runtime: container_scanner
• Credentials-aware: ssh_runner, password_auditor, metasploit
• Wordlist/filesystem fuzzers: dir_discovery, url-fuzzer-2, virtual-host-finder

Test plan

• python -m pytest testing/backend/unit/test_plugin_capabilities_inventory.py testing/backend/unit/test_capabilities.py testing/backend/unit/test_plugin_integrity.py -v (75 passed)
• python scripts/refresh_plugin_checksum.py --all
• All bundled plugins now declare explicit capabilities