feat: multi-distro VM tests, ja4ebpf eBPF improvements, bot-detector scoring

ja4ebpf:
- Refactor BPF TC capture with improved SYN offset handling and TCP option parsing
- Enhance TLS uprobe SSL hooking for better key extraction
- Add ClickHouse writer improvements for HTTP log materialized views
- Update RPM spec for Rocky Linux 8/9/10, fix systemd service
- Simplify loader with cleaner bpf2go integration

bot-detector:
- Add H2 SETTINGS per-parameter comparison in browser_matcher
- Enhance browser signatures and scoring pipeline
- Improve preprocessing and cycle detection

infra:
- Multi-distro Vagrantfile (centos8, rocky9, rocky10) with per-distro provisioning
- New Makefile targets: vm-up-all, test-vm-matrix, test-vm-centos8/rocky10
- Add debug helpers and run-test-from-host.sh for host-driven VM testing
- Update run-tests-vm.sh for cross-distro compatibility
- Remove accidental binary blob (\004)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/vm/provision.sh

@@ -50,14 +50,31 @@ EOF
 log "Installation de Docker..."
 dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
 dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
+
+# Sur el10+ (kernel 6.12+), nf_tables a des incompatibilités avec iptables-nft.
+# Désactiver la gestion iptables par Docker pour éviter l'échec au démarrage.
+if ! systemctl start docker 2>/dev/null; then
+    log "Docker: fallback iptables=false pour kernel $(uname -r)"
+    mkdir -p /etc/docker
+    echo '{"iptables": false}' > /etc/docker/daemon.json
+fi
+
 systemctl enable --now docker
 usermod -aG docker vagrant
 # Accès sans sudo pour vagrant
 chmod 666 /var/run/docker.sock || true
 
-# ── 5. nginx + openssl ───────────────────────────────────────────────────────
-log "Installation de nginx..."
+# ── 5. Serveurs web (nginx + httpd) + TLS + hitch + varnish ─────────────────────
+log "Installation des serveurs web et reverse proxy..."
 dnf install -y nginx openssl curl
+dnf install -y httpd mod_ssl
+dnf install -y hitch varnish
+
+# Ouvrir les ports HTTP/HTTPS dans le firewall
+log "Configuration firewall..."
+firewall-cmd --add-service=http --add-service=https --permanent 2>/dev/null || true
+firewall-cmd --add-port=80/tcp --add-port=443/tcp --permanent 2>/dev/null || true
+firewall-cmd --reload 2>/dev/null || true
 
 # ── 6. Python3 + outils de test ──────────────────────────────────────────────
 log "Installation Python3 et outils de test..."