Assess Plex security advisories in uploaded logs

[bullmoose20]

Plex versions observed in uploaded Kometa logs were checked only against the older 1.41.7–1.42.0 vulnerability window. Assess the September 2026 advisory against 1.43.3.10861 and show affected servers as critical findings, with a prominent result banner and the existing support-console counts.

• Add the authoritative, standard-library-only advisory definitions, strict numeric version parser, evaluator and historical observation grouping. Critical is Kometa's recommendation severity, not an official CVSS rating. No advisory HTTP requests or live server probes occur during analysis.
• Reuse PlexSecurityRule and the existing normal/streaming finding pipeline. Keep plex_security as the affected finding ID and add structured advisory/server/version/evidence/remediation data. Repeated evidence counts exactly beyond the display cap; each server/advisory counts once. Unknown versions produce neutral advice.
• Preserve the legacy vulnerability range and record overlapping evidence without a duplicate finding. Retain all observed historical versions; later patched observations do not erase earlier affected evidence or imply current server status.
• Bump analysis version to 9 for the existing retained-scan backfill. Existing raw log occurrence counts remain separate.

The audit found independent Quickstart and portal analyzers, with no importable shared Python core. This repository owns logscan_web/plex_security.py; the companion Quickstart PR vendors an identical copy with commit/SHA-256 provenance and an offline sync/check command. Future changes require syncing and releasing both repositories. Logged server names cannot distinguish different servers sharing a name. Details are in docs/plex-security.md.

Companion Quickstart integration: Kometa-Team/Quickstart#1915. Neither PR deploys or merges the other repository.

Validation:

• Full Python suite: 315 passed, 178 subtests passed; final parser/future-advisory and counting regressions: 41 passed.
• All 13 JavaScript tests, including the advisory banner test.
• Ruff, Black, ESLint and CSpell passed; mypy passed for the shared core.
• No production deployment or merge performed.