add: vm identity on discovery_sweep action

[PrashantBtkl]

Description

Adds a cloud-instance-identity probe to discovery_sweep: when SSH
credentials are supplied, every host that answers on the SSH port is
queried for AWS/GCP/Azure instance metadata (instance ID, region/zone,
public IP) over SSH, since IMDS endpoints are link-local and only
answer requests from the instance itself. Output is unparsed
key=value lines per host — parsing stays server-side so a parser fix
never needs an agent release.

This is the host-reported identity source described as the strongest
VM match key in nudgebee/nudgebee-enterprise#36059 ("One VM shows as
two assets when found by both the cloud collector and the discovery
agent"): it names exactly one cloud resource and self-scopes to the
right account, so — unlike MAC or private-IP matching — it needs no
datasource-to-account association to be unambiguous. This PR only adds
the collector; account-scoped matching/merge on the server side is
tracked separately in that issue.

Two commits:

• pkg/proxy/discovery/cloud_identity.go (+proxy.go, sweep.go):
  the probe itself, wired into discovery_sweep, no-op when no SSH
  credentials are configured on the datasource.
• cmd/standalone.go (+docs): exposes --user/--key/
  --password-env/--ssh-port on standalone forager sweep, so the
  probe is reachable without a relay too.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Enhancement (non-breaking change which improves existing functionality)
• Refactor (non-breaking change which improves code structure)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation
• CI/CD

How Has This Been Tested?

• Unit tests
• Manual testing

Checklist

• CLA signed (the CLA bot will prompt on your first PR)
• make validate passes (fmt + lint + test)
• Docs updated if the wire shape, config surface, or proxy module behavior changed

[gemini-code-assist]

Code Review

This pull request introduces a best-effort cloud instance identity probe during discovery sweeps. It adds a new file cloud_identity.go containing the shell script and logic to query IMDS endpoints (AWS, GCP, Azure) over SSH on discovered hosts, along with corresponding unit tests in cloud_identity_test.go. The Proxy.handleSweep method in proxy.go is updated to trigger this enrichment when SSH credentials are configured, and the SweepHost struct in sweep.go is updated with a new CloudIdentity field to store the raw probe output. There are no review comments, and we have no feedback to provide.