find: detect vulnerabilities across all principals, not just current user

[a5ucanc]

Overview

Enhanced the find command's vulnerability detection to provide comprehensive attack surface analysis by identifying all exploitable principals per vulnerability, rather than limiting results to the current authenticated user.

fixes #353

Key Changes

Comprehensive Vulnerability Detection

• Before: Vulnerabilities were only detected if exploitable by the current authenticated user
• After: All vulnerabilities are detected with a list of principals who can exploit each one

New vulnerability output structure:

{
  "ESC1": {
    "description": "Enrollee supplies subject and template allows client authentication.",
    "principals": ["DOMAIN\\User1", "DOMAIN\\User2", "DOMAIN\\ITGroup"]
  }
}

Principal Filtering

To keep output focused on actionable findings, well-known privileged groups (Domain Admins, Enterprise Admins, etc.) are excluded from the principals list. Since these groups inherently have dangerous permissions over templates (write, owner, etc.), including them would add noise without meaningful attack surface insight. Only custom/non-default groups and users are listed.

[ThatTotallyRealMyth]

I think this would be a solid addition : )