refactor(plugins): standardize plugin ID naming conventions to snake_case

[Rakshak05]

Closes #548

Description

This PR standardizes all plugin ID naming conventions to snake_case (lowercase letters, numbers, and underscores, removing all hyphens). This ensures consistent tooling, contributor expectations, and clean backend interfaces.

Key changes include:

• Backend Validation: Added regex ^[a-z][a-z0-9_]*$ matching and directory name matching consistency checks inside PluginMetadataValidator (plugin_validator.py).
• Plugin Migration: Renamed 8 non-conforming plugin folders and updated their IDs inside metadata.json. Removed the duplicate waf-detection plugin folder.
• Windows CRLF Checksum Normalization: Updated refresh_plugin_checksum.py to replace CRLF \r\n line endings in parser.py files with LF \n before hashing to match the backend and prevent test validation mismatches on Windows.
• Windows Path Sanitizer Support: Updated the wordlist resolver in plugins.py to return forward-slash posix paths on Windows to avoid backslashes being stripped by the shell input sanitizer.
• Database Migrations: Added SQL migration script 007_standardize_plugin_ids.sql to auto-migrate legacy historical plugin ID records in existing tables (tasks, findings, presets, presets, etc.) on server bootup.
• Documentation: Updated statistics in PLUGINS.md, guidelines in CONTRIBUTING.md, and entries in CHANGELOG.md.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

How Has This Been Tested?

• Plugin Validation Script: Ran python -X utf8 scripts/validate_plugins.py to verify all 59 plugins pass the new validator check cleanly.
• Backend Unit Tests: Ran python -m pytest testing/backend/unit/test_plugin_validator.py testing/backend/test_google_dorking_plugin.py testing/backend/unit/test_plugins.py to confirm all validator, manager, and contract tests pass successfully (139 passed).
• Environment: Tested and verified on Windows 11 with Python 3.11.9.

Checklist

• My code follows the code style of this project.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• My changes generate no new warnings.

[utksh1]

This is too large and too breaking to merge in its current form.

Blocking issues:

1. It changes many public plugin IDs and directories from hyphenated IDs to snake_case. Current main and recently merged tests still use hyphenated IDs such as subdomain-finder and website-recon-2, so this would break existing API/UI/history references without a complete compatibility layer.

2. The migration only covers stored database rows; it does not provide runtime aliases/redirects for API clients, presets, UI routes, queued tasks, existing external automation, or documentation links that still submit the legacy IDs.

3. The PR mixes multiple unrelated changes: plugin ID policy, directory renames, checksum script line-ending behavior, Windows path sanitizer behavior, WAF duplicate removal, docs, and parser additions. Please split this into smaller PRs so each behavior can be reviewed and reverted independently.

4. Because this is a breaking plugin contract migration, it needs explicit backwards-compatibility tests proving old IDs continue to resolve or fail with a deliberate migration path.

[utksh1]

Rechecking after the latest audit-exception commit: this is still blocked.

This refactor is already broad because it renames/standardizes plugin IDs. Please remove the unrelated .audit-config.yaml audit exception and keep the PR focused on plugin ID naming changes plus direct compatibility tests/docs. Audit policy changes need a separate review path.

[utksh1]

It looks like the 'backend-unit' CI tests are failing for this PR. Please run pytest locally to fix the broken unit tests and push the updates!

[Rakshak05]

@utksh1 Please review!

[utksh1]

Good progress on CI — all checks now pass. However, there are critical issues:

1. CRITICAL: backend/data/.api_key is in the diff. This is a credentials file and must NEVER appear in a PR diff, even with dummy values. Remove it immediately from the branch and ensure it's in .gitignore.

2. Squash branch history: The 16-commit history (including multiple merge commits and "Fixed bugs" messages) needs to be squashed into a clean, logical series — ideally 2-3 commits: (a) core refactor + migration, (b) plugin updates, (c) docs/tests.

3. Scope consideration: 68 files changed is inherently risky for a refactor that modifies public plugin IDs. Consider splitting into smaller PRs, or get explicit maintainer approval for the monolithic approach.

[Rakshak05]

Hii @utksh1, I've opened a new PR for the same issue with the changes requested in #2048. Could you please take a look when you get a chance?
I'll be closing this PR in the meantime.
Thanks!