feat: 统一服务缓存 + 指纹驱动插件匹配

将 webServiceCache 扩展为通用 serviceCache，所有指纹识别结果
统一缓存，插件匹配时端口不命中则回退到服务名称匹配。

删除多余的 service_cache.go，复用已有的 ServiceInfo 体系。
补充 nil 防御、Explicit 标记、大量单元/集成/回归测试。

webscan/web_scan.go

@@ -107,7 +107,7 @@ func buildTargetURL(info *common.HostInfo) (string, error) {
 	if info.URL == "" {
 		info.URL = protocolHTTP + net.JoinHostPort(info.Host, fmt.Sprint(info.Port))
 	} else if !hasProtocolPrefix(info.URL) {
-		info.URL = protocolHTTP + info.URL
+		info.URL = protocolHTTP + normalizeSchemelessWebTarget(info.URL)
 	}
 
 	// 解析URL以提取基础部分
@@ -115,6 +115,7 @@ func buildTargetURL(info *common.HostInfo) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("%w: %w", ErrInvalidURL, err)
 	}
+	parsedURL.Host = normalizeWebURLHost(parsedURL.Host)
 
 	return fmt.Sprintf("%s://%s", parsedURL.Scheme, parsedURL.Host), nil
 }
@@ -125,6 +126,32 @@ func hasProtocolPrefix(urlStr string) bool {
 	return strings.HasPrefix(urlStr, protocolHTTP) || strings.HasPrefix(urlStr, protocolHTTPS)
 }
 
+func normalizeSchemelessWebTarget(rawURL string) string {
+	authority := rawURL
+	suffix := ""
+	if idx := strings.IndexAny(rawURL, "/?#"); idx >= 0 {
+		authority = rawURL[:idx]
+		suffix = rawURL[idx:]
+	}
+	if strings.HasPrefix(authority, "[") {
+		return authority + suffix
+	}
+	if ip := net.ParseIP(authority); ip != nil && strings.Contains(authority, ":") {
+		return "[" + authority + "]" + suffix
+	}
+	return rawURL
+}
+
+func normalizeWebURLHost(host string) string {
+	if strings.HasPrefix(host, "[") {
+		return host
+	}
+	if ip := net.ParseIP(host); ip != nil && strings.Contains(host, ":") {
+		return "[" + host + "]"
+	}
+	return host
+}
+
 // scanByFingerprints 根据指纹执行POC
 func scanByFingerprints(ctx context.Context, target string, fingerprints []string, cfg *common.Config, session *common.ScanSession) {
 	for _, fingerprint := range fingerprints {