JVM probe (-javaagent): Java, Kotlin, Scala #74

Part of #51. A probe for Java, Kotlin, Scala and anything else on the JVM, built on the shared contract in #73.

Usage: no start-command change needed:

JAVA_TOOL_OPTIONS="-javaagent:/opt/secfoo/probe/jvm/secfoo-agent.jar" java -jar app.jar

Approach:

• Java 8+ (11+ primary), using java.lang.instrument with ASM or Byte Buddy. Instrument only the watched methods (Build a vulnerable-function watchlist from advisories #52 notation org.apache.logging.log4j.core.lookup.JndiLookup#lookup) with a counter, plus a stack sample on the first call. Watchlist reloads use retransformClasses.
• Inventory (Runtime package inventory: loaded versions, drift and live advisories #68): map each loaded class's CodeSource jar to Maven coordinates through META-INF/maven/**/pom.properties. Handle Spring Boot fat jars (BOOT-INF/lib) and WAR WEB-INF/lib. Mark shaded or relocated packages as shaded.
• Routes (Attribute runtime hits to live traffic (route, auth state) #69): a Servlet filter, Spring MVC BEST_MATCHING_PATTERN_ATTRIBUTE, Spring WebFlux, and JAX-RS @Path templates. Request context is held per thread and also works with virtual threads (Java 21).
• Transport through Probe ↔ sensor protocol and conformance kit (one contract for every runtime) #73, from a single daemon thread with a bounded queue.

Must not: read arguments, return values or fields; change class initialization order (no eager class loading); or break alongside other agents (APM, coverage). Test with a second agent attached.

Done when: Spring Boot and plain Servlet sample apps pass the #73 conformance kit, a Log4Shell-style watched method is reported as reached through its route, and an overhead benchmark is in the PR.