feat: segmentation policy checks, dual-stack exposure, signed evidence, unknown-service grouping

[NycolazSec]

Summary

Four audit features for verifying one's own network:

• tcpcat policy check <policy.yaml> --from <vantage>: segmentation testing as code. A YAML policy declares zones and, per vantage point, which TCP ports may (allow) or must (require) be reachable. Checked with TCP connect probes (no root). Exit 0 compliant / 1 violation / 2 error, with JSON and SARIF reports, so it can gate CI after a firewall change. tcpcat policy matrix merges reports from several vantages. Unknown policy keys are rejected (a typo can't turn a rule into "allow nothing"); --scope-file is honored.
• --dual-stack: scans the DNS-published IPv6 address of each IPv4 target on the same ports and reports ports open on IPv6 only — the usual sign of firewall rules written for IPv4 alone. tcpcat previously scanned only the IPv4 address of dual-stack names. New dual_stack JSON field and DUAL-STACK-IPV6-ONLY SARIF rule.
• --evidence <file> / --evidence-key, tcpcat evidence keygen|verify, tcpcat replay: a bundle of every open port (when, from where, how it answered; secrets redacted) with a SHA-256 digest and an optional Ed25519 signature (standard PKCS#8/PKIX PEM). replay refuses a tampered bundle, re-probes each finding and exits 0 only when all are fixed.
• Unknown-service grouping (with -sV): unrecognized banners are normalized and grouped across hosts, each group printed with a suggested signature; --fingerprints-out exports groups without addresses or raw banners.

Other changes: subcommands are dispatched before the scanner's flag parsing; SARIF locations bracket IPv6 addresses (tcp://[::1]:22). New dependency: go.yaml.in/yaml/v3 (the maintained YAML fork).

Checklist

• I read CONTRIBUTING.md
• gofmt -l . produces no output
• go vet ./... passes
• go test -race ./... passes
• I added/updated tests for behavioral changes
• I updated README.md/docs/ for user-facing changes
• This change preserves the authorized-use guidance in NOTICE.md and does not add functionality whose primary purpose is unauthorized access, disruption, credential theft, persistence, or concealment of unlawful activity

Test plan

• Unit tests for the four new packages (internal/policy, internal/dualstack, internal/evidence, internal/fingerprint).
• Full suite with -race, go vet, golangci-lint (0 issues) and gosec run in a Linux container; also run on macOS.
• End-to-end against local listeners:
  • policy: an extra open port and a missing required port are both reported, exit codes 0/1/2, JSON/SARIF/matrix output checked;
  • dual-stack: a service bound to ::1 only is flagged as IPv6-only for localhost;
  • evidence/replay: signed bundle verified, API key redacted, replay reports STILL OPEN then FIXED as services are stopped, a one-byte edit of the bundle is rejected;
  • grouping: the same unknown banner on 127.0.0.1 and ::1 is grouped with a working suggested regex, and the export contains no address.