feat: enforce operation scope for tool invocations and improve credential attribution

[l50]

Key Changes:

• Enforced operation scope on all single-IP tool invocations to prevent out-of-scope attacks
• Added robust parsing and normalization for FQDNs and SAM/NTDS credential dumps
• Improved attribution logic for secretsdump/nxc output to prevent domain pollution
• Introduced new ares_tools::scope module with comprehensive tests

Added:

• Operation scope enforcement system (ares_tools::scope) that restricts tool invocations to explicitly authorized IPs; includes OperationScope struct, scope initialization, and validation logic
• Automatic operation scope initialization in both orchestrator and worker startup, rejecting unauthorized single-IP tool executions before any subprocess runs
• Comprehensive unit tests for the new scope system, including environment variable parsing and edge cases
• FQDN normalization function in the Nmap parser to collapse adjacent duplicate labels, preventing malformed hostnames from polluting recon output
• Extensive tests for deduplication of FQDN labels and correct hostname extraction in Nmap parsing
• Additional secretsdump/nxc output parsing tests for local SAM markers, computer name prefix stripping, and machine account domain attribution

Changed:

• Tool dispatch logic now validates operation scope on every call, rejecting out-of-scope single-IP targets before execution
• Nmap output parser now normalizes FQDNs by collapsing duplicated leading labels, improving the accuracy of host attribution
• Secretsdump parser now recognizes both impacket and nxc/netexec SAM section markers, strips local computer name prefixes in the SAM section, and defaults to local SAM attribution for unmarked sections except for known domain-only accounts
• Enhanced secretsdump credential attribution to avoid leaking local-only users into the operator's AD domain scope, with safer defaults and more precise handling of machine accounts and krbtgt

Removed:

• Prior behavior that allowed single-IP tool invocations against any target, regardless of operation scope
• Legacy logic in secretsdump parser that attributed unmarked accounts to the AD domain by default, which risked domain pollution from local-only users

[codecov]

Codecov Report

❌ Patch coverage is 96.10390% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.06%. Comparing base (adee1a1) to head (1156c3b).

Files with missing lines	Patch %	Lines
ares-cli/src/orchestrator/mod.rs	0.00%	6 Missing ⚠️
ares-cli/src/worker/tool_executor.rs	0.00%	5 Missing ⚠️
ares-tools/src/parsers/secrets.rs	98.21%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #272      +/-   ##
==========================================
+ Coverage   75.99%   76.06%   +0.06%     
==========================================
  Files         386      387       +1     
  Lines       84059    84347     +288     
==========================================
+ Hits        63881    64157     +276     
- Misses      20178    20190      +12     

Files with missing lines	Coverage Δ
ares-tools/src/lib.rs	98.67% <100.00%> (+<0.01%)	⬆️
ares-tools/src/parsers/nmap.rs	99.73% <100.00%> (+0.02%)	⬆️
ares-tools/src/scope.rs	100.00% <100.00%> (ø)
ares-tools/src/parsers/secrets.rs	98.52% <98.21%> (-0.14%)	⬇️
ares-cli/src/worker/tool_executor.rs	73.61% <0.00%> (-0.69%)	⬇️
ares-cli/src/orchestrator/mod.rs	0.00% <0.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.