feat(modules): add encoded word matcher option

[TBX3D]

word matchers gain an optional encoding of hex or base64. when set, each
configured plaintext word is rendered into that encoding before matching,
so a marker that appears encoded in a response (a base64 blob, a hex dump)
can be matched by its known plaintext form. an unset encoding keeps the
existing literal behaviour byte for byte. an unknown encoding value is
rejected at module load.

[github-actions]

pr summary

4 files changed (+122 -8)

category	files
go source	4
tests	1

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 93.75000% with 2 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@a38ba0a). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
internal/modules/executor.go	91.66%	2 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #325   +/-   ##
=======================================
  Coverage        ?   64.98%           
=======================================
  Files           ?       88           
  Lines           ?     7887           
  Branches        ?        0           
=======================================
  Hits            ?     5125           
  Misses          ?     2369           
  Partials        ?      393           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[vmfunc]

clean. unset path stays byte-for-byte and the unknown-encoding reject reuses the validateMatchers load-time gate, exactly where it belongs. good reuse of encodeMatcherWord("") as the validator too.

two sharp edges to note in the module docs, both false-negative only so not blocking: base64 goes through StdEncoding, so it only matches when the marker is 3-byte aligned in the source blob, and it won't catch base64url (-_ , the JWT/web variant). and hex.EncodeToString is lowercase while checkWords is case-sensitive, so an uppercase hex dump slips past. fine for the opt-in heuristic, just don't want a rule author expecting it to catch a marker mid-blob.

in.

[TBX3D]

rebased. main added the range matcher and word case-insensitivity in the meantime, so the merge is a union rather than a replay: validateMatchers is one switch over favicon, range and word instead of the two ifs it grew from, Matcher carries Encoding alongside Source/Min/Max/CaseInsensitive, and the word matcher encodes first and then passes m.CaseInsensitive to checkWords. the merge commit is gone, so this is a single commit now.