TLS: surface non-UTF-8 SNI hostnames instead of silently dropping

[Zious11]

Context

Discovered during PR review of TLS analyzer (#2).

In src/analyzer/tls.rs, extract_sni() uses String::from_utf8(...).ok() which silently drops non-UTF-8 SNI hostnames. For a security tool, non-UTF-8 SNI could indicate C2 encoding or malware — worth surfacing rather than discarding.

Suggested Fix

Use String::from_utf8_lossy or surface the hex value when UTF-8 conversion fails. Optionally generate a low-confidence finding for non-UTF-8 SNI.