feat(scanner): add WebSocket malicious pattern detection

[dagangtj]

Summary

Implements scanner rules for detecting malicious WebSocket handlers.

Changes

Adds 5 new detection patterns for WebSocket-based attacks:

Pattern ID	Severity	Description
WS_SUSPICIOUS_ENDPOINT	high	WebSocket to suspicious/dynamic endpoints
WS_DATA_EXFIL	high	Data exfiltration over WebSocket
WS_REVERSE_SHELL	critical	Reverse shell patterns via WebSocket
WS_C2_PATTERN	critical	Command & control communication
WS_BIDIRECTIONAL_EXFIL	high	File/env read + WebSocket send

Test Cases (7 total)

• ✅ Suspicious endpoint detection (ngrok, dynamic URLs)
• ✅ Environment variable exfiltration
• ✅ Base64 encoded data transmission
• ✅ Exec/spawn in message handlers
• ✅ Eval-based C2 patterns
• ✅ File read + send patterns
• ✅ Negative test for legitimate usage

Closes #3

[vercel]

@dagangtj is attempting to deploy a commit to the Rapi's projects Team on Vercel.

A member of the Team first needs to authorize it.