Add masscan+nuclei mode, operator tuning controls, and vars file support to webrunner

- New scan mode: masscan+nuclei — masscan finds open ip:port pairs,
  nuclei runs operator-supplied CVE template against discovered hosts
- Per-country vulnerable host count in merge output via CIDR→country lookup
- Tuning args on every scan: --nmap-timing, --nmap-timeout, --nmap-workers,
  --nuclei-rate, --nuclei-concurrency, --nuclei-timeout, --masscan-rate
- Vars file support: operator provides scan_vars.yaml to pre-fill all
  tuning settings without interactive prompts
- Templates copied to nodes at provision time — no live fetches (OPSEC)
- run_scan.yml passes all tuning args with Ansible defaults as fallback
- configure_node.yml installs nuclei binary + uploads template on demand
- Updated deployment summary shows mode-specific tuning params
- countries-format.md and targets-format.md updated for new capabilities
- scan_vars.yaml.example documents all configurable settings with comments

modules/webrunner/tasks/run_scan.yml

@@ -22,6 +22,20 @@
       - "{{ masscan_rate }}"
       - --node-name
       - "{{ node_name }}"
+      - --nmap-timing
+      - "{{ nmap_timing | default(4) }}"
+      - --nmap-timeout
+      - "{{ nmap_timeout | default(60) }}"
+      - --nmap-workers
+      - "{{ nmap_workers | default(10) }}"
+      - --nuclei-rate
+      - "{{ nuclei_rate | default(150) }}"
+      - --nuclei-concurrency
+      - "{{ nuclei_concurrency | default(25) }}"
+      - --nuclei-timeout
+      - "{{ nuclei_timeout | default(10) }}"
+      - --template
+      - "{{ nuclei_template_remote | default('') }}"
   args:
     chdir: /root/webrunner
   register: scan_output
@@ -46,6 +60,20 @@
       - "{{ masscan_rate }}"
       - --node-name
       - "{{ node_name }}"
+      - --nmap-timing
+      - "{{ nmap_timing | default(4) }}"
+      - --nmap-timeout
+      - "{{ nmap_timeout | default(60) }}"
+      - --nmap-workers
+      - "{{ nmap_workers | default(10) }}"
+      - --nuclei-rate
+      - "{{ nuclei_rate | default(150) }}"
+      - --nuclei-concurrency
+      - "{{ nuclei_concurrency | default(25) }}"
+      - --nuclei-timeout
+      - "{{ nuclei_timeout | default(10) }}"
+      - --template
+      - "{{ nuclei_template_remote | default('') }}"
   args:
     chdir: /root/webrunner
   register: scan_output