Add scanmalware to the curated fast source set

[jonaslejon]

One line in FastSources, plus the README count. You ported the source in #1; this only
promotes it into -fast, so a default run queries it.

Disclosure: I run ScanMalware, so this is a vendor asking for a place in your default path.
Measured, not asserted, including the rows that argue against me.

20 domains, one 8-source run each, v2.19.0 built from fa8ef7b. "Sole finder" counts hosts no
other source in that same run reported. Resolve rate is a random sample of those hosts (A/AAAA,
3s), because volume alone proves nothing.

source	median	sole finder	resolve	errors
crt	0.296s	124,128	34.0%	0
scanmalware	0.397s	907	27.6%	0
thc	0.226s	995	12.0%	17
rapiddns	1.289s	160	89.4%	0
shodanct	0.153s	134	3.7%	2
submd	0.204s	0	n/a	0
sitedossier	3.001s	0	n/a	20
hackertarget	0.634s	0	n/a	20

Second of eight on sole-found hosts that actually resolve. Cost is +0.00s to +0.04s on a ~3s
run across five domains: three requests, no key, and it hides behind the slower sources.

Two things that undercut the table: sitedossier and hackertarget returned nothing from my
IP (20 errors each, the case your preflight probe exists for), so those rows understate them;
and it is one run per domain on one machine, so the small counts carry sampling noise.

Reproduce: subfaster -d <domain> -s thc,submd,crt,shodanct,rapiddns,hackertarget,sitedossier,scanmalware -oJ -cs -stats

gofmt, go vet and go test -short ./... clean; no test asserts the contents of
FastSources. Placed after crt to match where it lands on speed and yield. Happy to rework
it as a swap rather than growing the set, or to close it.

[melvinsh]

Checked locally on v2.19.0.

Speed: scanmalware itself was 327–558ms on eight domains, 3–4 requests, zero errors. Adding it to the default set did not stretch wall clock (still gated by sitedossier/shodanct).

Limits: anonymous API is 600 req/min, no daily quota. Fine for this use.

Extras: sole-finder hosts on tesla (3, 2 live), stripe (26, all live), adobe (137, ~half of a 40-host sample live). hackerone had none new. cloudflare's unique tail is mostly dead mail./www. CT names.

Operator is Jonas Lejon / Triop AB (556768-7321, Funäsdalen). Source only hits the three documented public GETs. Conflict was disclosed.

[melvinsh]

Thanks.

Merging this and tagging a release so default runs pick it up.