feat: add ntlm hash support for laps extraction and gmsa exploit detection

[l50]

Key Changes:

• Enabled LAPS extraction via NTLM hash (pass-the-hash) when plaintext credentials are unavailable
• Improved gMSA (Group Managed Service Account) detection and automatic exploit marking from secretsdump results
• Refined trust escalation logic to distinguish and track intra-forest and inter-forest paths
• Added logic to avoid futile unconstrained delegation attempts when the host is the domain controller

Added:

• LAPS extraction via NTLM hash - LAPS automation now generates work items for principals where only an NTLM hash is available, supporting pass-the-hash sweeps
• nt_hash field to LapsWork struct and downstream dispatch logic, enabling netexec to use -H for hash-based authentication
• Heuristic function (is_gmsa_principal) to identify gMSA accounts by SAM name and trailing $
• Automated gMSA exploit token emission when gMSA hashes are captured incidentally via secretsdump, even without explicit enumeration
• Unit tests for gMSA principal detection covering various edge cases

Changed:

• Trust escalation processing now distinguishes between intra-forest (child-to-parent) and inter-forest escalations, using different vulnerability IDs and types to improve scoreboard tracking and MITRE mapping
• Unconstrained delegation exploitation logic now skips attempts where the target host is the same as the domain controller, preventing known-failure scenarios and redundant work

Removed:

• Restriction on ACL discovery for dominated domains, allowing read-only enumeration to surface additional primitives even after domain takeover

[codecov]

Codecov Report

❌ Patch coverage is 96.67063% with 28 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (feat/more-attack-cov@0dd50c4). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
...s-cli/src/orchestrator/automation/unconstrained.rs	90.62%	9 Missing ⚠️
ares-cli/src/orchestrator/result_processing/mod.rs	43.75%	9 Missing ⚠️
ares-cli/src/orchestrator/automation/trust.rs	95.31%	6 Missing ⚠️
ares-cli/src/orchestrator/automation/laps.rs	99.28%	4 Missing ⚠️

Additional details and impacted files

@@                   Coverage Diff                   @@
##             feat/more-attack-cov     #277   +/-   ##
=======================================================
  Coverage                        ?   76.31%           
=======================================================
  Files                           ?      432           
  Lines                           ?   112928           
  Branches                        ?        0           
=======================================================
  Hits                            ?    86177           
  Misses                          ?    26751           
  Partials                        ?        0           

Files with missing lines	Coverage Δ
...s-cli/src/orchestrator/automation/acl_discovery.rs	81.94% <ø> (ø)
...es-cli/src/orchestrator/result_processing/tests.rs	100.00% <100.00%> (ø)
ares-tools/src/credential_access/misc.rs	91.30% <100.00%> (ø)
ares-cli/src/orchestrator/automation/laps.rs	92.79% <99.28%> (ø)
ares-cli/src/orchestrator/automation/trust.rs	26.31% <95.31%> (ø)
...s-cli/src/orchestrator/automation/unconstrained.rs	64.68% <90.62%> (ø)
ares-cli/src/orchestrator/result_processing/mod.rs	14.92% <43.75%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.