feat: gate ADCS ESC6/ESC9/ESC13 validation on KDC binding and harden vuln roles

[l50]

Key Changes:

• Introduced KDC StrongCertificateBindingEnforcement gating so ESC6 and ESC9 validation checks the DC of the certificate's own domain, correctly accounting for the KB5014754 (Feb 2025) default shift to Full Enforcement
• Added an ESC13 group-link verification step that distinguishes a genuinely exploitable issuance-policy link from a template that merely looks configured
• Made the ESC10 case 1, ESC13, and ESC7 Ansible roles idempotent and self-verifying to prevent silent partial-provision states
• Added comprehensive unit tests and documentation explaining the KDC binding hard gate across ADCS attack paths

Added:

• KDC binding resolution and ESC6 gating - Added kdcBinding, readKDCBinding, and checkESC6KDCBinding in cli/internal/validate/checks.go so an EDITF_ATTRIBUTESUBJECTALTNAME2 flag only passes when the validating DC's binding value is exactly 0, since a present security extension is rejected in both Compatibility (1) and Full Enforcement (2)
• ESC9 enforcement checks - Added checkESC9Enforcement and checkESC9KDCBinding that first confirm the template carries CT_FLAG_NO_SECURITY_EXTENSION, then require a binding value below 2, correctly treating Compatibility mode as exploitable for ESC9 (unlike ESC6)
• ESC13 group-link verification - Added checkESC13GroupLink and parseESC13GroupLink to confirm the issuance-policy OID carries an msDS-OIDToGroupLink and that exactly one OID object exists, with field-splitting parsing that avoids COUNT=10 matching COUNT=1
• KDC restart to ESC10 case 1 role - Added a conditional win_service restart of the KDC so the new binding mode actually takes effect, since the running KDC only reads the value at startup (ansible/roles/vulns_adcs_esc10_case1)
• Directory link verification to esc13.ps1 - Added a post-commit read-back of msDS-OIDToGroupLink that throws if the link did not land, since a silent no-op otherwise looks identical to success
• Test coverage - Added esc6_kdc_test.go, esc9_kdc_test.go, and esc13_link_test.go covering binding thresholds, cross-forest DC resolution, absent-value default behavior, transport errors, and probe parsing edge cases
• Documentation - Added a "KDC binding is a hard gate" section to docs/GOAD-vulnerabilities-comprehensive.md with a value/mode table, cross-referenced from the ESC6 and ESC9 entries, and updated docs/domains-and-users.md to note the weak KDC binding on DC03

Changed:

• ESC13 provisioning script - Reworked esc13.ps1 to reuse an existing issuance-policy OID and converge duplicate OID objects left by prior lab resets, rather than unconditionally creating a new OID and linking only one of them (ansible/roles/vulns_adcs_esc13/files/esc13.ps1)
• ESC7 PSPKI install - Guarded the Install-Module PSPKI step to skip and report unchanged when the module is already present, so an egress hiccup on a re-run no longer becomes fatal (ansible/roles/vulns_adcs_esc7/tasks/main.yml)
• Validator test defaults - Removed a redundant nil-check in TestNewValidator_Defaults, since NewValidator always returns a non-nil value (cli/internal/validate/validator_test.go)