fix: weak-credential check now inspects response body, not just HTTP status

[GovindarajanL]

Fixes #70

Summary

BrokenAuthenticationTestCase flagged a CRITICAL "Weak Default Credentials Accepted" finding whenever a login attempt returned HTTP 2xx, without checking whether the response body actually indicated success. Some APIs (e.g. VAmPI) return HTTP 200 for both successful and failed logins, with the real result only in the JSON body — producing a false CRITICAL.

Reproduction

Scanned VAmPI in both vulnerable=1 and vulnerable=0 modes. Both flagged POST /users/v1/login as accepting admin/admin. Manually replaying the exact request:

$ curl -s -X POST http://127.0.0.1:5001/users/v1/login -d '{"username":"admin","password":"admin"}'
{ "status": "fail", "message": "Username or Password Incorrect!"}

HTTP 200, but the login clearly failed.

Fix

Adds looksLikeAuthSuccess(), which requires the response body to be free of common failure markers ("status":"fail", incorrect, invalid credentials, unauthorized, ...) before trusting a 2xx status as a real success. Applied consistently to the weak-credential, missing-auth, JWT-none, expired-JWT, and 2FA-bypass checks in the same file, which all shared the identical status-code-only pattern.

Verification

• Re-ran against VAmPI vulnerable and secure instances after the fix: the false CRITICAL is gone in both (0, was 1); a failed weak-credential attempt now correctly falls through to the existing "Authentication Endpoint Requires Manual Review" (MEDIUM) finding instead.
• New regression tests added: one confirming the VAmPI-style 200-with-failure-body is no longer flagged, one confirming a genuine 200-success is still flagged.
• Full suite passes (241 tests).

Test plan

• mvn test passes
• Re-scanned VAmPI vulnerable/secure with the fixed jar — false CRITICAL confirmed gone, no loss of real findings