v13.33.2

What's Changed

• 🐛 cloudflare: bind the zone/account before reading sub-resource fields by @tas50 in #3236
• ci: migrate workflow runners to arc-runners by @username-is-already-taken2 in #3238
• 🧹 use users loggedIn resource on mac for query by @M-gre in #3241
• 🌟 content: map policies to OWASP Top 10:2025 + LLM Top 10, with coverage tests and gap-fill checks by @chris-rock in #3242
• 🧹 k8s testdata: shorten four over-length query titles by @tas50 in #3245
• 🧹 oci: replace deprecated fields in the OCI inventory querypack by @tas50 in #3246
• 🐛 content: restore OWASP Top 10:2025 mapping parity, fixing red main by @tas50 in #3249
• 🐛 oci: migrate VCN security list checks to typed rules, fixing a vacuous check by @tas50 in #3247
• 🧹 arista: migrate BGP peer route-map checks off deprecated fields by @tas50 in #3250
• 🧹 azure: migrate Front Door WAF check off deprecated wafPolicyId by @tas50 in #3251
• 🐛 vercel: fix vacuous protection-bypass check, scope it to the project by @tas50 in #3252
• 🧹 email: migrate PTR lookups off deprecated dns.reverse by @tas50 in #3254
• 🧹 ci: update content validation dependencies by @tas50 in #3255
• 🧹 aws: migrate IAM incident-response query off deprecated user.policies by @tas50 in #3256
• 🧹 Bump mql to v13.33.2 by @mondoo-mergebot[bot] in #3244

Full Changelog: v13.33.0...v13.33.2