refactor: 完成全局状态到 session 的完整迁移

将 plugins/services、plugins/local、plugins/web、webscan 层的日志输出、
漏洞结果保存和 TCP 计数器从全局 common.Log*/GetGlobalState() 迁移到
session 实例方法，确保 SDK 并发扫描时各实例完全隔离。

- 50 个文件，所有插件日志走 session.Log*
- DoRequest 加入 session 参数，计数器走 session.State
- POC 执行器通过 POCContext.Session 传递
- 仅保留 init() 和 CEL runtime 等无 session 场景的全局回退

plugins/services/elasticsearch.go

@@ -35,7 +35,7 @@ func (p *ElasticsearchPlugin) Scan(ctx context.Context, info *common.HostInfo, s
 
 	// 首先检测未授权访问
 	if p.testCredential(ctx, info, Credential{Username: "", Password: ""}, session) {
-		common.LogVuln(i18n.Tr("elasticsearch_unauth", target))
+		session.LogVuln(i18n.Tr("elasticsearch_unauth", target))
 		return &ScanResult{
 			Success: true,
 			Type:    plugins.ResultTypeVuln,
@@ -56,7 +56,7 @@ func (p *ElasticsearchPlugin) Scan(ctx context.Context, info *common.HostInfo, s
 
 	for _, cred := range credentials {
 		if p.testCredential(ctx, info, cred, session) {
-			common.LogVuln(i18n.Tr("elasticsearch_credential", target, cred.Username, cred.Password))
+			session.LogVuln(i18n.Tr("elasticsearch_credential", target, cred.Username, cred.Password))
 			return &ScanResult{
 				Success:  true,
 				Type:     plugins.ResultTypeCredential,
@@ -124,7 +124,7 @@ func (p *ElasticsearchPlugin) identifyService(ctx context.Context, info *common.
 
 	if p.testCredential(ctx, info, Credential{Username: "", Password: ""}, session) {
 		banner := "Elasticsearch"
-		common.LogSuccess(i18n.Tr("elasticsearch_service", target, banner))
+		session.LogSuccess(i18n.Tr("elasticsearch_service", target, banner))
 		return &ScanResult{
 			Success: true,
 			Type:    plugins.ResultTypeService,