fix: pin web security tool installs (ENG-8538)

[briangreunke]

Summary

• pin fallback ProjectDiscovery and supporting tool installs
• preserve prebaked runtime binaries, including replacing Python's unrelated httpx CLI
• require Node 24 for agent-browser 0.35.0 and skip browser downloads in sealed runtimes
• publish the change as web-security 1.0.4

Validation

• just validate
• pre-commit run --files capabilities/web-security/capability.yaml capabilities/web-security/scripts/install_tools.sh
• bash -n capabilities/web-security/scripts/install_tools.sh

Parent PR dreadnode/dreadnode-tiger#2526 must wait for this commit to land on capabilities main before updating its submodule pointer.

[briangreunke]

Superseded by #149, which reapplies the fix on current main and preserves the newer installer behavior. The source branch is retained.