.NET probe: startup hook + CLR profiler #75

Part of #51. A probe for .NET apps (C#, F#, VB), built on the shared contract in #73. It runs on Linux and Windows.

Usage: no code change needed:

DOTNET_STARTUP_HOOKS=/opt/secfoo/probe/dotnet/Secfoo.Probe.dll dotnet app.dll
# function-level hits additionally:
CORECLR_ENABLE_PROFILING=1 CORECLR_PROFILER={...} CORECLR_PROFILER_PATH=/opt/secfoo/probe/dotnet/secfoo_profiler.so

Approach, in two steps:

1. Managed startup hook (.NET 6+), with no native code. It covers inventory and routes:
   • Inventory (Runtime package inventory: loaded versions, drift and live advisories #68): AppDomain.GetAssemblies() plus the app's *.deps.json, mapped to NuGet package IDs and versions.
   • Routes (Attribute runtime hits to live traffic (route, auth state) #69): a DiagnosticListener on Microsoft.AspNetCore.Hosting.HttpRequestIn, with the template from RouteEndpoint.RoutePattern.RawText. Context is carried in AsyncLocal<T>.
2. CLR profiler (native, opt-in) for function hits. Use ReJIT on the watched methods only (Build a vulnerable-function watchlist from advisories #52 notation Namespace.Type#Method), with a counter and a first-call stack sample. Ship Linux x64/arm64 and Windows x64 builds.

.NET Framework 4.x: only the profiler applies. Document what works there.

Must not: read arguments or return values, or conflict with an APM profiler that is already attached. Detect it and fall back to step 1 only, with a warning.

Done when: an ASP.NET Core sample app passes the #73 conformance kit on Linux and Windows in CI, and the PR includes an overhead benchmark.