feat(sidecar): inspect Windows CA private key ACLs

[kev1n77]

Summary

• inspect both mitmproxy private-key files with native Windows owner/DACL APIs
• allow private material access only to the current user, SYSTEM, Administrators, and owner-rights principals
• classify null DACLs and unknown accessible principals as insecure, while preserving unchecked for unreadable or unsupported ACL shapes
• cover restricted and Everyone-readable ACLs with real Windows filesystem tests
• advance CAP-005 to 35%

Scope

This remains a read-only CAP-005 increment. System trust-store checks and privileged CA installation/removal are intentionally separate follow-up changes.

Verification

• cargo fmt --all -- --check
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• Tauri formatting, 10 native tests, and Clippy
• desktop frontend: 16 tests and production build
• sidecar addon/packaging: 17 tests