feat(detectors): Add transitive multi-hop taint propagation through intermediate tools (#10)

[IronLad123]

Closes #10

Summary

Adds transitive multi-hop taint propagation to TaintDetector in src/taintline/detectors/taint.py, enabling data-flow tracking through intermediate tool transformations (e.g. web_fetch -> format_text -> send_email).

Rationale & Key Features

• Bounded Propagation Depth: Configurable via typed field max_hops: int = 2 on TaintConfig.
• Transitive Lineage Tracing: Finding.span_ids names every span on the path (source, inter_1, ..., sink), and Finding.message formats the intermediate path explicitly (via intermediate tool(s) 'format_text').
• Sanitizer Gating: Any sanitizer span located temporally between source and sink suppresses the multi-hop taint finding.
• Deterministic & Pure: Pure depth-first search over trace.in_order() with no clock, RNG, network, or iteration-order leakage.

Verification

• Added 3 seeded fixtures under tests/fixtures/seeded/:
  • taint_two_hop_positive.json (positive 2-hop flow)
  • clean_two_hop_sanitized.json (sanitized 2-hop flow)
  • clean_two_hop_negative.json (clean 2-hop flow with no carry)
• Tested across PYTHONHASHSEED=0 and PYTHONHASHSEED=42.
• pytest: 56 / 56 passed (1.16s).
• ruff check: 0 errors.

[bamdadd]

Thank you @IronLad123 - this is a substantial and well-executed feature. The transitive propagation is genuine data-flow tracking: an intermediate is only on the path if it actually carries the tainted segment (segment present in its input AND its output feeds forward), so independent tools don't create false positives. I verified the invariant holds: deterministic across repeated runs, the sanitized and no-carry two-hop fixtures both stay clean, and max_hops bounds the depth. No LLM anywhere in the check path. Nice touch that the positive fixture legitimately surfaces both the direct and the via-intermediate flow. Squash-merged to main as 29012d8.

[bamdadd]

Merged via 29012d8. Thanks for the great work!