fix: wire validate_command_network_egress into execute_task

[ionfwsrijan]

Description

The function validate_command_network_egress() in validation.py inspects every command argument for network destinations against the safe-mode + network policy configuration. However, it is never imported or invoked anywhere in the execution pipeline (executor.py or routes.py). While the primary target field is validated, secondary plugin fields like proxy, virtual_host, config_file, and user_agent can contain arbitrary network destinations that bypass target validation entirely.

Fix: wire validate_command_network_egress() into executor.py's execute_task() right after the command is built and before Docker sandboxing, ensuring every command argument is validated.

Related Issues

• [BUG] validate_command_network_egress is Dead Code — Secondary Fields Bypass Target Validation #614

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

How Has This Been Tested?

The validate_command_network_egress function is now called after plugin_manager.build_command() completes and before subprocess execution. If any argument fails validation, a ValueError is raised, preventing task execution.

Checklist

• My code follows the code style of this project.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• My changes generate no new warnings.

[ionfwsrijan]

@utksh1 You may review and merge this

[utksh1]

Focused security fix wiring validate_command_network_egress into task execution before sandbox execution. Checks are green; approving.

[utksh1]

After #629 merged, this branch now conflicts with main because it carries the same CI baseline files. The security fix is still useful, but this PR is not mergeable now. Please rebase on latest main and keep only the validate_command_network_egress execution-path change plus its directly related validation change/tests.

[utksh1]

Re-reviewed after the latest update. The branch is no longer conflicted, but it still carries unrelated CI-baseline/frontend test changes in addition to the executor/validation security fix. Please rebase on latest main and narrow the PR to backend/secuscan/executor.py, backend/secuscan/validation.py, and directly related tests only.

[ionfwsrijan]

@utksh1 You may merge this now