Fix request context propagation for async executor tasks

[Mishenevd]

Summary

Context lives in a ThreadLocal, so it's only visible on the request-handling thread. When request-controlled input reaches a sink from a worker thread (ExecutorService, @Async, CompletableFuture, ForkJoinPool, a one-shot scheduled task), Context.get() returns null and scanning is silently skipped. This captures the context at task-submit time and restores it while the task runs on the worker.

Why this is a prerequisite

This unblocks two things:

1. Async context in general — any Zen check whose sink runs on a worker thread (async SQL, file access, etc.).
2. Async HTTP clients whose call runs on a java.util.concurrent executor. The concrete case is OkHttp's enqueue(): its Dispatcher is a ThreadPoolExecutor, so the call's DNS resolve + connect run on a worker thread. More generally, any outbound call made from a @Async / CompletableFuture / executor worker. Without propagation these see Context.get() == null and their SSRF / outbound-domain checks silently miss.

Netty-event-loop clients (Reactor Netty / Spring WebClient, Vert.x, AsyncHttpClient, AWS SDK async) do not go through these executors — they connect on Netty event loops and carry context via a channel attribute, which is handled separately, not by this PR.

What changed

• ContextPropagation + ContextPropagatingRunnable/Callable: capture the active ContextObject at submit, set it around the task, restore the worker's previous context afterwards. Idempotent; no-op when there's no context.
• Executor wrappers: ExecutorService.submit, ThreadPoolExecutor.execute, ForkJoinPool, ScheduledThreadPoolExecutor.schedule, and the Executors$Delegated* wrappers. Periodic scheduleAtFixedRate/WithFixedDelay are intentionally not wrapped — a request context must not persist across periods.
• ExecutorContextPropagation: cached reflection bridge from the bootstrap-woven advice to agent_api. A not-yet-set jar path during early startup is retried rather than permanently disabling propagation.

Testing

• Unit ContextPropagationTest: capture / restore / idempotency / exception paths.
• Integration ExecutorWrapperTest (runs under the agent): real ThreadPoolExecutor, ForkJoinPool, ScheduledThreadPoolExecutor.schedule, and Executors.newSingleThreadExecutor() propagate context to their worker threads.
• E2E spring_boot_postgres: async SQLi across CompletableFuture, ExecutorService, ThreadPoolExecutor, ForkJoinPool, ScheduledThreadPoolExecutor, and Spring @Async.

Not covered

Reactor/WebFlux context (separate), raw new Thread(...), periodic scheduled tasks, Kotlin coroutines, custom executors outside the covered JDK/Spring paths.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[aikido-pr-checks]

Summary by Aikido

Security Issues: 0	Quality Issues: 0	Resolved Issues: 0

🚀 New Features

• Added context capture and restoration for asynchronous executor tasks
• Added propagation wrappers for executors, fork-join, and scheduled tasks
• Added reflective bootstrap bridge to agent API context propagation

⚡ Enhancements

• Made propagation idempotent and restored previous worker contexts safely

^{More info}