feat: add IDOR testing as a 6th parallel pipeline

[mesutgungor]

Implements Insecure Direct Object Reference (IDOR) vulnerability analysis and exploitation as a new parallel agent pair in the pentesting pipeline, addressing a gap in the Business Logic Testing coverage (WSTG-BUSLOGIC).

The IDOR agent is distinct from the existing authz agent: authz checks whether access control guards exist on endpoints, while IDOR specifically audits whether object ownership is enforced at the data access layer (e.g. missing AND user_id = $currentUser in queries).

Changes:

• Add idor-vuln and idor-exploit agents to ALL_AGENTS and VulnType
• Add playwright-agent6 for isolated parallel browser execution
• Register agents in AGENTS, AGENT_PHASE_MAP, MCP_AGENT_MAPPING, AGENT_VALIDATORS
• Add idor to VULN_TYPE_CONFIG in queue-validation service
• Include idor_exploitation_evidence.md in final report assembly
• Add IDOR_ANALYSIS, IDOR_QUEUE, IDOR_EVIDENCE deliverable types to MCP server
• Add runIdorVulnAgent and runIdorExploitAgent activity functions
• Wire IDOR into buildPipelineConfigs (pipeline grows from 5 to 6 pairs)
• Add vuln-idor.txt: full analysis prompt covering direct/indirect references, mass assignment, cross-object references, and enumeration feasibility
• Add exploit-idor.txt: exploitation prompt with sequential enumeration, UUID substitution, filename forging, and write/delete IDOR techniques
• Add pipeline-testing variants for fast iteration