Detection: add Kotlin support (SQLi + command injection)

[bkd-dotcom]

Umbra covers Python, JS, Go, Java, Ruby, PHP, C#. Add Kotlin (.kt) — its JVM
sinks mirror Java, so this is mostly wiring.

Where:

• umbra_core/pipeline/findings/multilang.py: add a .kt ruleset (SQLi via string
  concat in executeQuery/createStatement, command injection via
  ProcessBuilder/Runtime.exec).
• umbra_core/pipeline/findings/lang_taint.py: add a Kotlin LangTaintSpec.
• umbra_core/pipeline/findings/engine.py: add .kt to _SCAN_EXTS.

Acceptance criteria

• SQLi + command injection detected in a .kt file (inline and taint-through-var).
• Zero FP on parameterized PreparedStatement / arg-list ProcessBuilder.
• Tests; pytest -q + ruff green.

Reference: the existing Java rules/spec (Kotlin is very close). See CONTRIBUTING.md.