fix(tools): harden scope enforcement, credential storage, and subproc…

[vpadival]

Hey, Tyler! I found a handful of security and reliability issues while going through
the codebase. Here's what this PR addresses:

Filter_live_targets_httpx: fallback was returning the full unverified
target list instead of [], causing noisy downstream scans

Run_feroxbuster_tool: feroxbuster_out.json was deleted at the start
of each loop iteration, so a crash on target N would wipe target N-1's findings.
Moved deletion outside the loop.

Scope bypass: An empty scope list was allowing all targets through.
Added an early return of [] when scope is empty (L57–61)

Plaintext credentials- credentials were being logged to SQLite
in plaintext. Added hashing before storage (L195–206)

WPScan token in argv- API token was visible in process arguments.
Moved to environment variable instead (~L408)

SSL verify disabled- urllib.request.urlopen was called with no
SSL verification. Added proper SSL context (~L472)

Scope suffix logic- subdomain suffix matching was too permissive,
allowing unintended targets through. Tightened the match logic (L54–67)

Subfinder timeout (Informational)- subprocess had no timeout, risking
indefinite hangs. Added a reasonable timeout (~L238)

Happy to adjust anything if needed!
(Pls check if I made the same mistake of removing ur previous PRs last time😅)