feat(scanners): dns hijacking scanner

[lcampbell2]

Implements a new subdomain-takeover scanner service and wires it into existing DNS scan output:

• Adds a Go microservice under scanners/subdomain-takeover that consumes scans.dns_scanner_results and publishes normalized findings to scans.findings.upsert (to be continued)
• Introduces passive takeover classification for both CNAME and NS signals, including reason codes and confidence levels (suspected, probable, confirmed).
• Adds provider fingerprint infrastructure (embedded JSON data + loader/types), with deterministic NS candidate ranking and vulnerable-only NS emission.
• Implements robust JetStream worker behavior (Ack on success, Nak on retryable failures, Term on decode/poison messages).
• Uses (fix(dns-scanner): extended CNAME/NS results #7442) changes to emit richer takeover inputs: ns_delegations and registrar_context (RDAP lookup + delegation comparison).

[lcampbell2]

/gcbrun

[lcampbell2]

/gcbrun(6ecde7d)