feat(recon): add kubeflow pipelines and metaflow exposure modules

[TBX3D]

detect an anonymously reachable kubeflow pipelines apiserver, whose
same api accepts pipeline run submission with an attacker-supplied
workflow manifest (arbitrary container execution), and a metaflow
metadata service leaking flow and owner enumeration. match distinctive
snake_case json keys with status 200, fail closed on empty instances
to avoid the bare-substring false-positive class.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@7ea1cd2). Learn more about missing BASE report.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #290   +/-   ##
=======================================
  Coverage        ?   54.75%           
=======================================
  Files           ?       81           
  Lines           ?     6874           
  Branches        ?        0           
=======================================
  Hits            ?     3764           
  Misses          ?     2842           
  Partials        ?      268           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

pr summary

3 files changed (+195 -0)

category	files
go source	1
tests	1

[vmfunc]

key-triple AND'd with 200 is the right anchor on both, and the fail-closed metaflow case (empty [] carries none of flow_id/user_name/ts_epoch) is the correct tradeoff. extractors are clean, no backtracking.

one non-blocking note: the kubeflow path is v1beta1 only, so a KFP 2.x deployment on /apis/v2beta1/pipelines slips through. same response shape, so it's a one-line paths: add whenever you feel like it. not gating on it.

in.