feat: add Fail2ban security detection console

deploy/security/cmpp-http-scan.conf

@@ -0,0 +1,3 @@
+[Definition]
+failregex = ^<HOST> .* "(?:GET|POST|HEAD) /(?:\.env|\.git|wp-admin|wp-login\.php|phpmyadmin|vendor/phpunit|actuator|cgi-bin)(?:[/? ][^\"]*)?" (?:400|403|404) .*$
+ignoreregex =

deploy/security/cmpp-report-only.conf

@@ -0,0 +1,8 @@
+[Definition]
+# Detection remains report-only. The fixed action is installed by the deployment
+# script and can only forward Fail2ban's matched IP/jail values to the local collector.
+actionstart =
+actionstop =
+actioncheck =
+actionban = /opt/cmpp-platform/current/bin/cmpp-security-agent report <name> <ip>
+actionunban =

deploy/security/cmpp-security-agent.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=CMPP restricted security execution agent
+After=network.target fail2ban.service nftables.service
+
+[Service]
+Type=simple
+User=root
+Group=cmpp-security
+EnvironmentFile=/etc/cmpp-platform/cmpp-platform.env
+ExecStart=/opt/cmpp-platform/current/bin/cmpp-security-agent
+Restart=on-failure
+RestartSec=3
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/run/cmpp-security-agent /var/lib/cmpp-security-agent /etc/nginx/snippets /etc/fail2ban/jail.d
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_KILL
+AmbientCapabilities=CAP_NET_ADMIN CAP_DAC_OVERRIDE
+LockPersonality=true
+MemoryDenyWriteExecute=true
+
+[Install]
+WantedBy=multi-user.target