Return ScanResult with metrics from async scan methods

[trosenblatt]

This PR builds on the previous CPU duration histogram metric PR to expose timing information to callers through the async scan method APIs.

Changes

1. New Public Types

ScanMetrics - Contains timing information:

• total_duration: Total time for the entire scan
• io_duration: Time spent in async I/O operations
• num_async_rules: Number of async rules that were executed

ScanResult - Returned by async scan methods:

• matches: Vec - The list of rule matches
• metrics: ScanMetrics - Timing metrics for the scan

2. Updated Async Scan Methods

• scan_async() now returns Result<ScanResult, ScannerError>
• scan_async_with_options() now returns Result<ScanResult, ScannerError>

Breaking Change: Callers need to access matches via result.matches instead of using the result directly.

3. Synchronous Methods Unchanged

• scan() and scan_with_options() still return Result<Vec<RuleMatch>, ScannerError>
• No breaking changes for synchronous callers

4. Internal Changes

• internal_scan now returns (Vec<RuleMatch>, Duration, usize) tuple
• internal_scan_with_metrics constructs and returns ScanResult
• Updated async tests to use new result.matches API

Migration Guide

Before:

let matches = scanner.scan_async(&mut event).await?;
for match in matches { ... }

After:

let result = scanner.scan_async(&mut event).await?;
for match in result.matches { ... }

// Access metrics
println!("Total: {:?}", result.metrics.total_duration);
println!("I/O: {:?}", result.metrics.io_duration);

Testing

• All 293 tests passing
• Updated async tests to use new API
• Backward compatibility maintained for sync methods

🤖 Generated with Claude Code