Add complimentary preflight for Security Tools detection

[NoaheCampbell]

What this PR does / why we need it:

Mirrors the recent support bundle analyzer into the host preflight to better and more clearly show interference from antivirus tools before installation issues occur. This emits warnings (not failures) and includes the list of detected tools plus guidance.

Which issue(s) this PR fixes:

https://app.shortcut.com/replicated/story/129800/add-complimentary-preflight-for-security-tools-detection

Does this PR require a test?

NONE

Does this PR require a release note?

NONE

Does this PR require documentation?

NONE

[github-actions]

This PR has been released (on staging) and is available for download with a embedded-cluster-smoke-test-staging-app license ID.

Online Installer:

curl "https://staging.replicated.app/embedded/embedded-cluster-smoke-test-staging-app/ci/appver-dev-c81ee1c" -H "Authorization: $EC_SMOKE_TEST_LICENSE_ID" -o embedded-cluster-smoke-test-staging-app-ci.tgz

Airgap Installer (may take a few minutes before the airgap bundle is built):

curl "https://staging.replicated.app/embedded/embedded-cluster-smoke-test-staging-app/ci-airgap/appver-dev-c81ee1c?airgap=true" -H "Authorization: $EC_SMOKE_TEST_LICENSE_ID" -o embedded-cluster-smoke-test-staging-app-ci.tgz

Happy debugging!

[sgalsaleh]

I see the collector attempts to collect multiple system packages, would this analyzer exactly message look correct if the collector finds more than one?

[NoaheCampbell]

Yeah youre right, it looks like it would render that message for each tool it detects, I'll make a commit that should render it as a single message

[sgalsaleh]

@ajp-io should review the copy here.

[sgalsaleh]

@ajp-io should review the copy here.

[AmberAlston]

@ajp-io I know you reviewed this copy in the original ticket but can you confirm here since Salah tagged you for review. Also @sgalsaleh it looks like this needs a rereview

[NoaheCampbell]

When installing microsoft defender on an Ubuntu VM and running the host-preflight.yaml, the analysis.json file will have the following section

  {
        "name": "detect.threat.management.and.network.security.tools",
        "labels": {
            "desiredPosition": "1",
            "iconKey": "kubernetes_text_analyze",
            "iconUri": "https://troubleshoot.sh/images/analyzer-icons/text-analyze.svg?w=13\u0026h=16"
        },
        "insight": {
            "name": "detect.threat.management.and.network.security.tools",
            "labels": {
                "iconKey": "kubernetes_text_analyze",
                "iconUri": "https://troubleshoot.sh/images/analyzer-icons/text-analyze.svg?w=13\u0026h=16"
            },
            "primary": "Detect Threat Management and Network Security Tools",
            "detail": "The following antivirus or network security tools were detected: wdavdaemon\n. These types of tools have been known to interfere with Kubernetes operation in various ways. If you experience an installation problem, you may need to disable these tools temporarily as part of the troubleshooting process to identify if any system administrator exceptions may be required to maintain necessary internal Kubernetes operations.",
            "severity": "warn"
        },
        "severity": "warn",
        "analyzerSpec": ""
    },