feat: show dynamic analysis results in the view command

[ayoubfaouzi]

Summary

Extends view <sha256> with a Dynamic Analysis section sourced from the behavior_reports summaries on the file document and the public /v1/behaviors/{id}/ endpoints:

• Sandbox runs table: every run with status, OS/guest profile, time, duration, rule/artifact/screenshot counts and failure class, newest first, with a ▸ marker on the run rendered in detail
• Run detail: sandbox environment, attempts, full failure info, evidence summary, and activity counts (network/file/registry events via cheap per_page=1 pagination probes)
• Capabilities grouped by severity (high → suspicious → informative), deduplicated
• Process tree nested by parent PID with per-process detections, cycle-safe
• New --behavior-id/-b flag to display a specific run; auto-selection mirrors the web-ui (default report if completed, else newest completed)

Supporting changes:

• Replace the stale File.BehaviorReportID field with default_behavior_id + the behavior_reports summary map, matching the current API schema
• New GetBehaviorReport (always uses ?fields= projection — the unfiltered doc inlines the entire API trace) and CountSysEvents webapi methods, fanned out concurrently
• Fetches are structured around the current schema-v2 contract: env is guaranteed on the doc, while capabilities/proc_tree are omitempty and a projection on a missing field fails the whole lookup — so they are fetched individually and tolerantly, degrading gracefully instead of aborting the report
• OS column falls back to the digest-bound guest profile ID since the sandbox pipeline does not always echo os back into the behavior scan config
• Default detonation timeout bumped to 30s

Test plan

• 13 new unit tests: webapi client (httptest, including the 400 bad-field path) and pure functions (run selection fallback, process-tree nesting incl. orphan/cycle/duplicate-PID cases, tree rendering)
• Verified against a mock API: populated report, missing sub-document degradation, failed-run rendering, count-failure n/a paths
• Verified against live api.saferwall.com: empty state, unknown --behavior-id error, and fully populated reports (three sandbox runs of a GandCrab sample)
• go build, go vet, go test ./... all pass