Add TLS and certificate-management contracts

[RonaldHensbergen]

Summary

Implements the Compose-side scope of #205: a cds security rule that flags production profiles exposing plaintext HTTP endpoints without a TLS reverse-proxy in front of them, plus an explicit waiver mechanism.

• cli/resources/profile.schema.json: adds spec.security.waivers.plaintextEndpointExposure.reason (required, non-empty string) for profiles that intentionally accept plaintext exposure.
• cli/security.py:
  • _module_provides_plaintext_http() / _plan_has_tls_reverse_proxy() detect, from the plan, whether any module provides an http-service contract with protocol: http and whether a reverse-proxy contract with protocol: https is present.
  • _port_is_non_local_host_exposure() treats any non-127.0.0.1/localhost/::1 published port as an external exposure.
  • _check_production_plaintext_exposure() reports a new CDS-SEC-074 (high) finding for production profiles with plaintext exposure and no TLS reverse-proxy; if spec.security.waivers.plaintextEndpointExposure.reason is set instead, it emits a W098 warning diagnostic with the waiver reason instead of failing.
  • _try_render_compose_for_scan() now also returns the resolved plan so the new rule can inspect module contracts, not just the rendered Compose output.
  • reason added to _NON_SECRET_PATH_SUFFIXES so waiver-reason text isn't mistaken for a secret value by the entropy/secret-matching rules.
• tests/fixtures/security/plaintext-exposure/: new fixture modules (apps/plain-api, network/secure-ingress) and three profiles (profile-with-tls, profile-missing-tls, profile-waived-plaintext) covering the valid/missing/waived TLS cases end-to-end.
• tests/test_cds_workflow.py / tests/test_security.py: new end-to-end and unit coverage for all three cases.

Out of scope (tracked separately, per #205's runtime delivery boundary)

• Kubernetes certificate resources and enforcement — Kubernetes Support Implementation Plan #65
• Shared reverse-proxy/TLS contract in shared/contracts/, TLS requirement fields on existing HTTP/database/cache contracts, and the certificate/key reference mechanism described in Add TLS and certificate-management contracts #205's remaining work items

Testing

• python -m unittest discover -s tests -p "test_*.py" -v — 609 tests, all pass (1 skipped)
• make lint — passes
• coverage run -m unittest discover -s tests -p "test_*.py" && coverage report -m — 85% (gate is 65%)

Resolves #205