fix(scan): correlate cname before confirming subdomain takeover

[TBX3D]

the live-response path flagged any host whose body matched a provider
fingerprint without checking dns, so a page merely containing a
provider 404 string was reported as a takeover. resolve the cname and
only confirm when it maps to the same provider; a contradicting cname
kills the flag. providers with a body signature but no apex to
correlate, and unresolvable lookups, degrade to a medium potential
finding via a new confidence field rather than confirming or dropping.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 73.33333% with 8 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@7ea1cd2). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
internal/scan/subdomaintakeover.go	76.92%	6 Missing ⚠️
internal/finding/finding.go	50.00%	1 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #281   +/-   ##
=======================================
  Coverage        ?   54.80%           
=======================================
  Files           ?       81           
  Lines           ?     6893           
  Branches        ?        0           
=======================================
  Hits            ?     3778           
  Misses          ?     2844           
  Partials        ?      271           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

pr summary

5 files changed (+146 -21)

category	files
go source	5
tests	3

[vmfunc]

logic's right, and the three-way split (confirmed / dropped-on-contradiction / potential) is the correct shape for this. reusing danglingProvider for the body path so it lines up with the no-such-host path is the right call.

two non-blocking things:

• "confirmed"/"potential" are bare literals in scan, and finding.go compares against a bare "potential". give them named consts off SubdomainTakeoverResult so the two packages can't drift on a typo.

• serviceCorrelatable leans on danglingProvider's apex suffixes, which are region-blind. a real regional s3 endpoint (bucket.s3.us-west-2.amazonaws.com) won't match .s3.amazonaws.com, so for a correlatable provider that path drops the finding entirely instead of degrading to potential. it's the same narrowness the dangling path already has so nothing new here, but worth a follow-up on the apex map.

in.