Verification is moved into a dedicated verifyWhoxy function returning
(bool, error), so FromData records the outcome and appends the result
unconditionally. The status-code interpretation is carried over verbatim;
no verified or invalid outcome changes.
Previously the request-construction, transport and response-read failures
each fell through to `continue` or were swallowed, so the candidate was
either discarded outright or reported as unverified with no error attached.
All three now surface as an indeterminate verification error, so the finding
is stored and its last-seen date is refreshed on the next scan.
It is registered behind a new WhoxyDetectorEnabled feature flag, following
the pattern used for recently added detectors. The flag is enabled in
main.go, and the detector type joins the test's feature-flag-gated exclusion
group because buildDetectorList drops a gated detector when its flag is unset.
Shahzad Haider
b5b59a727f