feat: gate ADCS ESC6/ESC9 on same-domain KDC certificate binding

[l50]

Key Changes:

• Made ESC6 and ESC9 exploitability depend on the KDC's StrongCertificateBindingEnforcement value in the certificate's own domain, closing a gap where CA-side and template-side probes reported green while a patched KDC silently killed the attack routes (KB5014754 moved the default to Full Enforcement in Feb 2025)
• Added the adcs_esc10_case1 KDC binding pin to the DC that owns the CA and vulnerable templates in GOAD and GOAD-variant-1, and made the role restart the KDC so the new binding mode actually takes effect
• Introduced per-domain KDC binding validation that fails ESC6 (requires value 0) and ESC9 (requires value ≤1) when the KDC is missing, unset, or enforcing, rather than passing on CA/template flags alone
• Reworked the scoreboard so KDC-bound ADCS techniques are only credited when a weak binding is pinned in the same domain as the CA

Added:

• KDC restart step in the adcs_esc10_case1 role so the new binding mode takes effect immediately, gated on a changed registry write - ansible/roles/vulns_adcs_esc10_case1/tasks/main.yml
• readKDCBinding helper and kdcBinding struct that resolve the validating DC for a certificate's domain and read its enforcement value, shared by ESC6 and ESC9 - cli/internal/validate/checks.go
• ESC9 enforcement checks (checkESC9Enforcement, checkESC9KDCBinding) that verify both the template drops the SID security extension and the KDC still accepts a weak mapping - cli/internal/validate/checks.go
• Same-domain KDC gating in the scoreboard via weakCertBindingDomains and kdcBoundADCSTechniques, so ESC6/ESC9 are only credited when the pin lives in the CA's domain - cli/internal/scoreboard/generate.go
• Comprehensive ESC9 KDC binding test suite covering enforcement thresholds, absent values, missing templates, and same-domain DC resolution - cli/internal/validate/esc9_kdc_test.go
• Scoreboard tests pinning KDC-bound technique gating, including the GOAD shape where a permissive KDC in another forest must not credit the route - cli/internal/scoreboard/topology_gating_test.go
• New "KDC binding is a hard gate" documentation section with an enforcement-mode table and notes on the moved default and event 39 log level - docs/GOAD-vulnerabilities-comprehensive.md

Changed:

• ESC6 validation now treats an absent StrongCertificateBindingEnforcement value as Full Enforcement (FAIL) rather than unknown (WARN), reflecting the KB5014754 default, and points operators to the adcs_esc10_case1 vuln to pin it - cli/internal/validate/checks.go
• Enabled adcs_esc10_case1 in the CA/template domain for both GOAD and GOAD-variant-1 - ad/GOAD/data/config.json, ad/GOAD-variant-1/data/config.json
• Split the monolithic topology gating test into focused functions per concern to stay under the gocyclo threshold, and renamed ESC6 test helpers (esc6Lab/esc6Envelope to kdcBindingLab/kdcEnvelope) for reuse by ESC9 - cli/internal/scoreboard/topology_gating_test.go, cli/internal/validate/esc6_kdc_test.go
• Documented the ESC6/ESC9 KDC dependency across compromise-path and domain docs, including corrected ESC9 prerequisites (value 0 or 1) and the meereen pin note - docs/domain-compromise-paths.md, docs/domains-and-users.md, docs/GOAD-vulnerabilities-comprehensive.md, ansible/roles/vulns_adcs_esc10_case1/README.md