dedupe: replace 5 duplicated flag-check functions with unified registry

[ryanfowler]

Summary

Replace ~250 lines of duplicated flag-checking code spread across 5 functions with a single declarative flag registry.

Before

Three nearly-identical "iterate over Cli fields and check if set" patterns existed:

Function	Location	Lines
append_shared_ignored_request_flags	inspection.rs	~30 flags
append_shared_ignored_auth_flags	inspection.rs	~5 flags
append_shared_ignored_response_flags	inspection.rs	~10 flags
validate_from_curl_exclusives	app.rs	~40 ConflictRule entries
validate_websocket_exclusives	app.rs	~50 ConflictRule entries

Each structurally identical — check cli.field.is_some(), push a string.

After

A single src/flag_registry.rs defines every flag once with name, category, predicate, and per-context boolean inclusion tags. Each use case filters the same registry.

• inspection.rs: 117 → 28 lines (-76%)
• app.rs: ConflictRule enum + both validators 210 → 42 lines (-80%)
• dns/inspect.rs: manual TLS/http-version checks replaced by registry categories

Details

• Preserves WebSocket-specific --retry 0 behavior via optional is_ws_conflict predicate
• Excludes --dns-server from DNS inspection ignored flags (it selects the resolver)
• Adds regression test for --inspect-dns --dns-server not being reported as ignored
• Flag names in inspection warnings now list individual flags (--data) instead of combined groups (--data/--json/--xml)

Validation

• ✅ cargo fmt --check — clean
• ✅ cargo clippy --locked --all-targets --all-features -- -D warnings — clean
• ✅ 829 unit tests passed
• ✅ All 8 integration test suites passed