feat(tencent/security): expose 10 scans as cobra subcommands

[rafeegnash]

Summary

Adds clanker tencent security <scan> for the ten Tencent Cloud security scans that previously lived only on the in-process HTTP server (clanker server). The downstream clanker-cloud Security panel needs them as shell-out targets, matching the inventory / cost / expiry pattern.

Each scan registers through a small securityScan struct so adding a new one is one append, not three. The fan-out clanker tencent security all runs every scan in parallel and emits a wrapped envelope — per-scan failures are surfaced inside the envelope rather than aborting the bundle, so a single IAM gap doesn't black out the other nine scans.

Surface

clanker tencent security public-exposure --region ap-singapore
clanker tencent security clb-exposure --region ap-singapore
clanker tencent security db-exposure --region ap-singapore
clanker tencent security idle-eips --region ap-singapore
clanker tencent security unencrypted-cbs --region ap-singapore
clanker tencent security cert-expiry --days 30
clanker tencent security cam-hygiene
clanker tencent security waf-coverage
clanker tencent security antiddos-coverage --region ap-singapore
clanker tencent security audit-coverage
clanker tencent security all  # wrapped envelope across all 10

All scans emit raw JSON on stdout — same shape the HTTP server already returns, so jq pipelines and the dashboard share a wire format.

Output of security all

{
  "region": "ap-singapore",
  "scans": [
    {"name":"public-exposure","data":{...}},
    {"name":"cam-hygiene","error":"permission denied: cam:DescribeSubAccount"}
  ]
}

Test plan

• go test -race -count=1 ./internal/tencent/... -run Security — 3/3 pass
• go test -race -count=1 -short ./... — full suite green
• go vet ./... — clean
• gofmt -s -l — clean
• Manual: clanker tencent security --help lists 11 subcommands (10 scans + all)