Improve zero trust shadow SaaS evidence

[DENGXUELIN]

Closes #1711.

Summary

• add application discovery and shadow SaaS evidence gates to zero-trust-assessment
• require IdP/ZTNA/CASB/SWG/proxy/DNS/firewall/SaaS-admin reconciliation before scoring application maturity
• add vulnerable and benign fixtures for shadow SaaS, direct-to-SaaS bypass, unmanaged OAuth, and VPN-only private apps

Validation

• git diff --check origin/main...HEAD
• Markdown fence balance check
• added-line ASCII check
• content marker check for ZT-APP-* / ZT-VIS-06 findings and fixtures
• git merge-tree --write-tree origin/main HEAD

Bounty

Requested tier: Improver Moderate, USD 100 if accepted.