Fix gowitness URL correlation failures

[aconite33]

Summary

• Fixes Gowitness fails to correlate screenshots/network logs/technologies due to URL mismatch #2984
• PR Fix gowitness bug #2974 partially addressed gowitness KeyError crashes but missed the screenshot section and didn't fix the root cause (URL mismatch between input and gowitness DB)
• Gowitness may record URLs with a different scheme and/or port than the input (e.g. http://host:443/ instead of https://host/, or http://host:443/ instead of http://host/ after redirect). This causes event_dict lookups to fail.
• Add _url_key() that produces a scheme-and-port-agnostic key (hostname + path) for correlation, used both when building event_dict and when looking up from the DB
• Use .get() with graceful fallback for the screenshot section (missed by PR Fix gowitness bug #2974)
• Separate stdin_urls list to preserve original URLs sent to gowitness while using normalized keys in event_dict

Test plan

• All 4 existing gowitness tests pass
• Verified against live scan with targets that trigger scheme/port mismatches (CDN-fronted hosts redirecting HTTP→HTTPS)

[github-actions]

📊 Performance Benchmark Report

Comparing 3.0 (baseline) vs mtr/gowitness_fix (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	4.26ms	4.24ms	-0.6% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	17.46ms	17.38ms	-0.4% ⚪	✅
Large Closest Match Lookup	352.11ms	347.91ms	-1.2% ⚪	✅
Realistic Closest Match Workload	190.17ms	185.54ms	-2.4% ⚪	✅
Event Memory Medium Scan	1769 B/event	1768 B/event	-0.0% ⚪	✅
Event Memory Large Scan	1757 B/event	1757 B/event	+0.0% ⚪	✅
Event Validation Full Scan Startup Small Batch	406.31ms	406.73ms	+0.1% ⚪	✅
Event Validation Full Scan Startup Large Batch	583.40ms	577.97ms	-0.9% ⚪	✅
Make Event Autodetection Small	30.72ms	30.50ms	-0.7% ⚪	✅
Make Event Autodetection Large	312.72ms	312.11ms	-0.2% ⚪	✅
Make Event Explicit Types	13.67ms	13.73ms	+0.5% ⚪	✅
Excavate Single Thread Small	3.953s	3.988s	+0.9% ⚪	✅
Excavate Single Thread Large	9.730s	9.457s	-2.8% ⚪	✅
Excavate Parallel Tasks Small	4.133s	4.131s	-0.0% ⚪	✅
Excavate Parallel Tasks Large	7.246s	7.196s	-0.7% ⚪	✅
Is Ip Performance	3.15ms	3.15ms	-0.2% ⚪	✅
Make Ip Type Performance	11.52ms	11.42ms	-0.8% ⚪	✅
Mixed Ip Operations	4.51ms	4.49ms	-0.4% ⚪	✅
Typical Queue Shuffle	62.45µs	60.40µs	-3.3% ⚪	✅
Priority Queue Shuffle	703.54µs	685.87µs	-2.5% ⚪	✅

🎯 Performance Summary

✅ No significant performance changes detected (all changes <10%)

---

🐍 Python Version 3.11.15

[codecov]

Codecov Report

❌ Patch coverage is 89.28571% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 91%. Comparing base (de31418) to head (05e5393).
⚠️ Report is 26 commits behind head on 3.0.

Files with missing lines	Patch %	Lines
bbot/modules/gowitness.py	82%	6 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff          @@
##             3.0   #2985   +/-   ##
=====================================
- Coverage     91%     91%   -0%     
=====================================
  Files        436     436           
  Lines      36918   36959   +41     
=====================================
+ Hits       33567   33587   +20     
- Misses      3351    3372   +21     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.