feat(web-security): add HTTP desync tooling and smuggling skill

[GangGreenTemperTatum]

Ports the http-desync-smuggling research (11 confirmed mechanism families from PortSwigger's HTTP Terminator) into web-security as a Dreadnode toolset plus a companion skill.

What's added

tools/desync.py — DesyncTools, four tools:

Tool	Purpose
desync_fingerprint	Which body-framing primitives the stack accepts — Server/CDN, TE chunked/identity/gzip, duplicate Content-Length, CL on bodyless GET. Seven probes run concurrently; a failed probe omits its field rather than aborting the fingerprint.
desync_build_payload	Byte-exact raw HTTP/1.1 for 11 families. Content-Length and chunk sizes are computed from the real byte count.
desync_probe_cache	Cache-layer detection plus cache-key membership — decides whether a confirmed desync escalates to cache poisoning.
desync_analyze_responses	Classify victim-response-theft captures (session cookies, JWT, bearer, CSRF, PII) into a severity. Values redacted; full secrets never returned.

skills/http-desync-smuggling/SKILL.md — the 11 families with per-family family slugs, tool-driven phases, the interleaved-victim validation algorithm, and a permutation table.

Cross-refs added from te0-request-smuggling and response-queue-poisoning; all Chain With targets verified to exist.

Changes from the source material

• Payload construction is new. The source had none — the skill carried hand-written HTTP blocks with hardcoded Content-Length: 50 values that don't match their bodies. An agent copying those sends a malformed request and reads the resulting 400 as "not vulnerable." Lengths and chunk sizes now derive from real byte counts.
• Async with concurrent probes instead of sequential blocking calls with sleep(1) between cache GETs. Fingerprint completes in ~0.4s.
• Uniform null-omitted dict returns instead of mixed dataclass/str, per the repo's tool-authoring rules.
• proxy is a per-call arg, not a hardcoded Caido default — a Toolset field would be unreachable to the LLM.
• Dropped feedback_loop.py / db_fingerprint.py. SQLite glue for HTTP Terminator's own campaign DB, no consumer here.

Verification

• 97 new tests — payload byte-correctness per family, redaction, severity ordering, probe behaviour against a mocked transport.
• Full capability suite: 429 passed.
• just validate clean; tools 44 → 48, skills 81 → 82. Remaining warnings (caido-cli, burp, caido_proxy) are pre-existing on main.
• Unit tests can't prove framing is wire-correct, so each built payload was also sent over a raw TLS socket to a live server. All eleven drew a semantic parser response (400 on CL/TE conflict, 501 on unknown TE, 405/200 otherwise) with no resets or hangs.

Reviewer notes

• unkeyed_headers is a lead, not a fact. The Age-differential heuristic can't distinguish "header isn't in the cache key" from "Age just didn't move." A cache_key_method field states this inline so an agent doesn't report it as confirmed.
• gitleaks caught the original test fixtures (synthetic JWT + session value scanning as real secrets). They're now built programmatically rather than allowlisted, so the hook keeps working for genuine leaks.
• verify=False on probes is deliberate and documented in the module docstring: targets under test routinely present self-signed or expired certs, and a verification failure would mask the framing behaviour being measured.
• Version bumped 1.9.0 → 1.10.0 (additive public surface).