feat(malware-check): add whitespace check to detect excessive spacing and invisible characters

[AmineRaouane]

Summary

This PR adds a new heuristic that analyzes code to detect suspicious use of excessive spaces and invisible characters. It checks whether the amount of spacing and invisible Unicode characters exceeds a defined threshold.

Description of changes

• Implemented the WhiteSpaces heuristic in a new Python module.
• Registered the new heuristic inside the main heuristics.py file.
• Created unit tests to verify the behavior of the WhiteSpacesAnalyzer heuristic.
• Updated detect_malicious_metadata_check.py to integrate and execute the new heuristic logic during analysis.
• The heuristic scans the codebase for abnormal invisible characters and spaces in the code.
• This heuristic is combined with ForceSetup to justify high confidence in detection, as the presence of extra spaces alone could be due to poor formatting rather than malicious intent.

Related issues

None

Checklist

• I have reviewed the contribution guide.
• My PR title and commits follow the Conventional Commits convention.
• My commits include the "Signed-off-by" line.
• I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
• I have updated the relevant documentation, if applicable.
• I have tested my changes and verified they work as expected.

[art1f1c3R]

Small typo, "The" instead of "THe"

[art1f1c3R]

Could you walk me through the rationale of why we should combine WHITE_SPACES failing with the forceSetup rule and why these rules together are a malicious indicator with HIGH confidence?

[AmineRaouane]

because it implies, not only that harmful code may be executed during the installation process, but also that there appears to be an effort to hide the form of this code which strongly suggests malicious motives.