[fynnth]

Transport security and DICOM for C# and Java

This adds detection rules mainly for csharp and a few for java.

What's in it

OpenSSL via P/Invoke : the bulk of the work. Ciphers with their mode and key length
(AES-256-GCM, DESede168-CBC), digests, MACs, key generation (RSA-4096, DSA-2048,
named curves from numeric NIDs), KDFs with their iteration counts, RNG, and the TLS side:
protocol versions from both *_method() and set_min/max_proto_version, plus cipher lists
resolved to IANA suite names.

.NET TLS : SslStream's handshake methods, the protocol properties on the various
options objects, Kestrel's UseHttps, the legacy ServicePointManager switch, and
CipherSuitesPolicy, which expands into the algorithms behind each suite.

Schannel : direct SSPI P/Invoke. Protocol versions and the security package name only:
the modern credential structure carries deny-lists rather than anything a caller requests,
and a disabled algorithm is not an algorithm in use.

DICOM: fo-dicom on the C# side (client and server) and dcm4che on the Java side,
including whether the association is TLS-protected and which versions it offers. Details are not always possible in which case it just reports dicom with or wothout TLS (not reporting exact versions).

Java SSL : a few gaps closed around SSLParameters endpoints and enabled settings.

Alongside that, some engine fixes the rules needed: array initializers and their elements
were invisible to the C# engine, hex literals were classified as strings, and a flags
combination (Tls12 | Tls13) inferred as int rather than as the enum it is.

Notes for review

• The dcm4che test jars are fetched during the build rather than checked in, because of
  their licence. If the download fails or is unavailable, those tests skip and the build
  still passes.
• Where an API only lets a caller forbid something, we deliberately report nothing. (mainly for schannel)