Kingfisher v2.1.0

[v2.1.0]

• Added GitHub App authentication for GitHub organization scans. Configure
  KF_GITHUB_APP_ID, KF_GITHUB_APP_INSTALLATION_ID, and either
  KF_GITHUB_APP_PRIVATE_KEY or KF_GITHUB_APP_PRIVATE_KEY_PATH to let Kingfisher
  sign short-lived App JWTs and mint a fresh installation token immediately before
  each repository clone, allowing scans to run beyond GitHub's one-hour installation-token
  lifetime. A complete App configuration takes precedence over KF_GITHUB_TOKEN, which
  continues to support personal access tokens and pre-minted installation tokens. #488
• Further improved read-only AWS and GCP blast-radius role-impact analysis, included by default. AWS maps
  direct and one-hop assumable IAM roles; GCP maps impersonatable service accounts, inherited
  roles, and hierarchy scopes. Reachable roles and their policy grants are preserved in JSON,
  TOON, SARIF, and HTML reports/viewers.
• Added direct single-finding blast-radius mapping with kingfisher blast-radius --rule <RULE> <SECRET>, including stdin and component variables. Exposed Blast Radius Cmd in all report formats, aligned pretty output labels, and documented JSON/jq command extraction in the defender workflow.
• Added HTTPS Basic Auth validation for Betterleaks' generic-credential-uri rule. Kingfisher
  sends credentials only after an unauthenticated request receives an explicit Basic challenge;
  plaintext HTTP and endpoints without authoritative authentication evidence remain inconclusive.