Add CNAPP integration commands and helpers

[jpkeepersecurity]

Title

Add CNAPP integration commands and helpers

Summary

Adds a new pam cnapp ... command tree to Commander that drives the krouter CNAPP (Cloud-Native Application Protection Platform) REST endpoints, giving CLI parity with the vault's Cloud Security view. The initial provider is Wiz; the wire/proto layer is provider-agnostic so additional CNAPP vendors can be added without further CLI changes.

Includes the protobuf definitions, a thin helper layer that owns the wire contract, the argparse-driven command surface, and a unit-test suite that exercises the real proto serializers against a mocked router transport.

Changes

• keepercommander/commands/discoveryrotation.py — register PAMCnappCommand under the pam group with alias cn.
• keepercommander/commands/pam/cnapp_commands.py (new, 608 lines) — full pam cnapp command tree:
  • pam cnapp config set | test | test-encrypter | read | delete — manage the provider configuration and health-check the customer-deployed Encrypter.
  • pam cnapp queue list | associate | remediate | set-status | delete — drive the issue queue (list with optional payload decryption, attach a vault record, dispatch remediation to the gateway, update status, delete).
  • Client-side AES-256-GCM decryption of queue payloads using the Encrypter key resolved from the linked vault record. Wire format mirrors decryptCnappQueueItem in vault/cloudSecurityUtils.ts so the CLI and vault see the same plaintext.
  • --format table|json on read/list commands for scripting.
• keepercommander/commands/pam/cnapp_helper.py (new, 241 lines) — single source of truth for the krouter wire contract. One Python function per endpoint under /api/user/cnapp/, plus enum parsers (provider_from_name, action_from_name) and UID conversion utilities. Callers pass parsed Python types; the helper builds the proto, dispatches via _post_request_to_router, and returns the typed response.
• keepercommander/proto/cnapp_pb2.py (new, 181 lines) — generated protobuf bindings for cnapp.proto, covering CnappConfiguration, queue request/response messages, CnappProvider (currently WIZ), and CnappRemediationAction (ROTATE_CREDENTIALS, MANAGE_ACCESS, JIT_ACCESS, REMOVE_STANDING_PRIVILEGE).
• unit-tests/pam/test_cnapp.py (new, 837 lines) — coverage for enum parsing, helper-level request shaping for every endpoint, command-level argument validation and output rendering (table + JSON), payload decryption (happy path + bad-key + missing-key fallback), and status-name → id resolution.

Cross-references

• Server: krouter routes under /api/user/cnapp/... (configuration/{set,test,test-encrypter,read,delete}, queue, queue/{associate,remediate,set-status,delete}).
• Vault: queue payload envelope and Encrypter-key custom-field label kept in sync with vault/cloudSecurityUtils.ts (CNAPP_ENCRYPTION_KEY_FIELD_LABEL = "Encryption Key", AES-256-GCM with nonce(12) || ciphertext || tag(16)).
• Status enum mirrors CnappQueueStatus from CnappModels.kt / keeper.cnapp_queue_status — new statuses must be added in both places.

Notes / limitations

• krouter currently only dispatches ROTATE_CREDENTIALS; the other remediation actions are wired through the proto but return RRC_BAD_REQUEST server-side until those flows are implemented.
• config read never returns clientSecret; passing an empty --client-secret to config set instructs krouter to keep the previously stored value.
• queue list falls back to showing payloads as encrypted (with a warning) when no Encrypter key can be resolved from the linked vault record; --no-decrypt opts out explicitly.

Test plan

• python -m unittest unit-tests.pam.test_cnapp -v passes locally.
• Against a krouter test environment with a Wiz tenant:
  • pam cnapp config set persists; pam cnapp config read returns the same network/provider/endpoint/client-id (and no secret).
  • pam cnapp config test succeeds with valid creds and fails cleanly with the provider's reason on bad creds.
  • pam cnapp config test-encrypter --url https://... returns OK for a healthy Encrypter and surfaces a clear error otherwise.
  • pam cnapp queue list --network-uid ... renders the table with decrypted summaries (severity · title · resource) when the Encrypter record is in the vault; the same call with --no-decrypt shows encrypted and a warning.
  • pam cnapp queue list --format json emits valid JSON with decryptedPayload populated and the raw payload field stripped.
  • pam cnapp queue associate then pam cnapp queue remediate ... rotate_credentials round-trips through the gateway and queue list reflects the new status.
  • pam cnapp queue set-status pending|in_progress|resolved|failed|cancelled and numeric ids both work; unknown names raise a CommandError listing the valid options.
  • pam cnapp config delete and pam cnapp queue delete succeed and subsequent reads return the expected empty/RRC_BAD_STATE responses.

[smunoz-ks]

Hope to review this week, since not a priority today.