feat: multi-distro VM tests, ja4ebpf eBPF improvements, bot-detector scoring

ja4ebpf:
- Refactor BPF TC capture with improved SYN offset handling and TCP option parsing
- Enhance TLS uprobe SSL hooking for better key extraction
- Add ClickHouse writer improvements for HTTP log materialized views
- Update RPM spec for Rocky Linux 8/9/10, fix systemd service
- Simplify loader with cleaner bpf2go integration

bot-detector:
- Add H2 SETTINGS per-parameter comparison in browser_matcher
- Enhance browser signatures and scoring pipeline
- Improve preprocessing and cycle detection

infra:
- Multi-distro Vagrantfile (centos8, rocky9, rocky10) with per-distro provisioning
- New Makefile targets: vm-up-all, test-vm-matrix, test-vm-centos8/rocky10
- Add debug helpers and run-test-from-host.sh for host-driven VM testing
- Update run-tests-vm.sh for cross-distro compatibility
- Remove accidental binary blob (\004)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

services/ja4ebpf/config.yml.example

@@ -1,33 +1,26 @@
 # Configuration de l'agent ja4ebpf
 # Copiez ce fichier en config.yml et adaptez les valeurs.
 
-# Interface réseau à surveiller (hook TC ingress)
+# Interface réseau à surveiller (XDP ingress)
 interface: eth0
 
-# Processus à instrumenter via uprobes SSL
-ssl_probes:
-  - executable: /usr/sbin/httpd
-    symbol: SSL_read
-  - executable: /usr/lib64/libssl.so.3
-    symbol: SSL_read
+# Chemin vers libssl pour les uprobes SSL_read/SSL_write
+ssl_lib_path: "/usr/lib64/libssl.so.3"
+
+# Mode debug : dump compteurs BPF + événements consommés toutes les 5s
+# ClickHouse optionnel en mode debug
+debug: false
 
 # Paramètres de connexion ClickHouse
 clickhouse:
-  addr: "127.0.0.1:9000"
-  database: "ja4_logs"
-  table: "http_logs_raw"
-  username: "default"
-  password: ""
-  tls: false
+  dsn: "clickhouse://default:@127.0.0.1:9000/ja4_logs"
   batch_size: 500
-  flush_every: "2s"
+  flush_secs: 1
 
 # Délais de corrélation et de détection
-timeouts:
-  # Durée sans activité avant expiration d'une session TCP
-  session_expiry: "500ms"
-  # Délai maximum pour une requête L7 sans réponse (détection Slowloris)
-  slowloris: "10s"
+correlation:
+  timeout_ms: 500        # expiration session TCP (ms)
+  slowloris_ms: 10000    # seuil Slowloris (ms)
 
 # Journalisation
 log: