add resource-trusts slice

[TacoRocket]

What changed

• added a new resource-trusts Phase 2 slice with operator-first rows for Storage and Key Vault trust surfaces
• correlated existing Storage and Key Vault collectors into public-network, anonymous-access, and private-endpoint trust paths
• wired the command through CLI, help, README, table output, fixtures, golden outputs, and schema contracts

Why it changed

• this is the next bounded roadmap slice after keyvault, and it keeps the resource trust boundary narrow instead of sprawling into unrelated service coverage
• the slice reuses existing evidence from storage and key vault posture rather than inventing new unsupported semantics

Impact

• AzureFox can now summarize broad network trust versus private-link trust for Storage and Key Vault in one operator-first command
• findings from the underlying resource collectors are surfaced alongside the new trust rows

Validation

• python3 -m pytest
• python3 -m ruff check src/azurefox tests scripts