v13.25.0

What's Changed

• ✨ support terraform context (and more) in SARIF output by @arlimus in #2937
• 🧹 Replace arduino/setup-protoc with a self-contained install script by @czunker in #2941
• content/querypacks: derive Windows AD OU from registry instead of PowerShell by @M-gre in #2942
• ✨ aws: internet-exposure + cross-resource exposure checks by @tas50 in #2918
• 📝 Add PR-review guidance for bots to CLAUDE.md by @tas50 in #2943
• ✨ aws: add 4 runtime ECS container security checks by @tas50 in #2929
• 🧹 Ignore Vim swap files by @tas50 in #2944
• 🐛 aws: fix S3 bucket policy checks erroring on policy-less buckets by @tas50 in #2946
• 🐛 content: export internet-exposure inventory for the attack graph by @AdamVB in #2953
• 🧹 Replace deprecated MQL fields in AWS policies by @tas50 in #2732
• Bump fastify/github-action-merge-dependabot from 3.14.0 to 3.15.0 by @dependabot[bot] in #2951
• Bump mondoohq/actions/cnspec-lint from 13.1.0 to 13.2.0 by @dependabot[bot] in #2950
• Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #2949
• Bump softprops/action-gh-release from 3.0.0 to 3.0.1 by @dependabot[bot] in #2948
• 🐛 aws: fix Lambda URL auth check erroring on functions with no URL by @tas50 in #2947
• feat(azure): keyless (WIF) onboarding for cnspec integrate azure by @vjeffrey in #2945
• 🧹 Update mondoo.com/docs URLs to their current canonical targets by @tas50 in #2955
• 🧹 Bump mql to v13.25.0 by @mondoo-mergebot[bot] in #2956

Full Changelog: v13.24.2...v13.25.0