feat(properties): bind excluded-semantic-detection-headers and detection-max-scan-seconds

[rennf93]

Closes #22

Adds guard.excluded-semantic-detection-headers and guard.detection-max-scan-seconds to GuardProperties with their GuardPropertiesMapper lines, plus binding assertions in GuardPropertiesBindingTest (shown failing on master: excludedSemanticDetectionHeaders bound [], then passing).

The pinned engine (9067b7b) predates the two builder fields, so the engine pin moves to 09dfddf (guard-core-jvm #53) in ci.yml, code-ql.yml, release.yml, settings.gradle.kts and the docs that name it.

I diffed the full SecurityConfigBuilder field list against GuardProperties: only these two bindable fields were missing. The remaining builder-only names (authVerifier, cloudIpStore, customRequestCheck, customResponseModifier, geoIpHandler, onBlock, onError) are callbacks or handler objects reachable through customizers, and dynamicRulesCachePathRaw and the three logSensitive*Raw fields are internal twins of properties that are already mapped.

Local gate: ./gradlew spotlessCheck detekt build --no-daemon passes with Redis on 6379.