Add AWS-equivalent public port checks for Alibaba Cloud ECS security groups

[owenchenxy]

Summary

Alibaba Cloud currently provides ECS security-group checks for unrestricted SSH (22) and RDP (3389), but it lacks the broader public-port coverage available for AWS EC2 security groups. Add equivalent Alibaba Cloud checks for unrestricted ingress from 0.0.0.0/0 and ::/0.

Proposed checks

• All protocols and ports
• High-risk TCP ports: 25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088
• Telnet: 23
• MySQL: 3306
• PostgreSQL: 5432
• SQL Server: 1433, 1434 (TCP)
• Oracle Database: 1521, 2483
• MongoDB: 27017, 27018
• Cassandra: 7199, 9160, 8888
• Redis: 6379
• FTP: 20, 21 (TCP)
• Elasticsearch/Kibana: 9200, 9300, 5601
• Kafka: 9092
• Memcached: 11211

Shared semantics

• Evaluate Accept/Drop and protocol values case-insensitively.
• Support bounded port ranges and protocol ALL.
• Evaluate both unrestricted IPv4 and IPv6 sources.
• Respect Alibaba Cloud rule priority (lower number wins, with Drop winning ties) within the audited security group.
• Return MANUAL, not PASS, when ingress rules cannot be completely retrieved.
• Suppress redundant service-port findings when the all-protocol/all-port check already fails.

Intentional exclusions

AWS checks that depend on ENI attachment state or arbitrary globally routable source CIDRs are not direct cross-provider equivalents and should be handled separately. This issue is limited to exact unrestricted sources (0.0.0.0/0 and ::/0).

Dependency

This work builds on the Alibaba Cloud security-group policy normalization in #12049.

[danibarranqueroo]

Hello @owenchenxy! Thanks for suggesting all of this new checks and for doing the PR, we'll review it as soon as possible 🙌