fix: improve acl vuln routing and certipy_shadow hash handling

[l50]

Key Changes:

• Refined dispatcher logic to correctly route ACL-based vulnerabilities to the acl worker instead of defaulting to privesc
• Added robust detection for ACL-style vuln types to support correct worker selection
• Improved certipy_shadow tool to ignore empty-string hashes, preventing failures
• Enhanced documentation and validation for certipy_shadow input handling

Added:

• ACL-style vuln detection - Introduced is_acl_style_vuln_type function in task_builders.rs to identify and route ACL-based vulnerabilities to the appropriate worker
• Unit tests for ACL vuln type detection - Ensured correct matching and rejection for bare and prefixed ACL types in task_builders.rs
• Unit tests for certipy_shadow hash handling - Verified that empty-string hashes are ignored and password fallback works in adcs.rs

Changed:

• Vulnerability routing in dispatcher - Updated logic in Dispatcher::submit_exploit_task to use the new ACL detection and route vulnerabilities with ACL primitives to the acl worker when recommended_agent is empty
• certipy_shadow argument handling - Modified adcs.rs to treat empty-string hashes as missing, ensuring Certipy does not receive invalid hash arguments and the password fallback is used correctly
• Tool definition documentation - Clarified input schema and parameter requirements for certipy_shadow in the tool registry to prevent misuse of password and hashes fields

Removed:

• Legacy default behavior that always routed empty recommended_agent exploits to the privesc worker, which led to toolset mismatches for ACL-based vulnerabilities