doctor: wildcard-exposure check misses JVM- and BEAM-hosted services

[Mapika]

Follow-up from #60, which added kafka, cassandra, neo4j, rabbitmq and others to SENSITIVE_PROCESSES. Those four entries can never match, and the reason is worth writing down because it affects any future addition to that list.

check_wildcard_exposure compares p.process_name for exact equality, and process_name is the executable, read from /proc/<pid>/exe on Linux. A JVM service's executable is java:

$ ss -tlnp
LISTEN 0 50 *:19998 *:* users:(("java",pid=27293,fd=5))

$ portview 19998 --json
[{"port":19998,...,"process":"java","command":"java Srv.java",...}]

So Kafka, Cassandra and Neo4j all report as java, and RabbitMQ reports as beam.smp (the Erlang VM). None of them will ever equal their own name.

This predates #60 — elasticsearch has been in the list since the beginning with exactly the same problem.

Why not just add java to the list: it would warn on every JVM process that binds a wildcard address, the large majority of which are ordinary web services that are supposed to be reachable. The check's value is that it is quiet unless something is actually wrong.

Where: src/doctor.rs, check_wildcard_exposure.

The distinguishing information is in the command line, not the executable — PortInfo already carries command. Something along the lines of: keep matching the executable first, and where the executable is a known runtime host (java, beam.smp, python, ruby, node), look for the service in command instead. A Kafka broker's command line contains kafka.Kafka; Cassandra's contains CassandraDaemon.

Worth being careful about false positives: matching a bare substring like kafka against a whole command line will also fire on --log-dir=/var/log/kafka-consumer-test. The existing tests in doctor::tests named wildcard_* are the place to pin down whatever rule you land on, and the port a service is listening on is useful corroborating evidence (9092 for Kafka, 5672 for RabbitMQ).