[FEATURE] semantic matchers: type: llm matchers and extractors

Follow-up to #3480. Add type: llm matchers and extractors that judge a response per target where patterns can't. Runs during the scan, on the response. Not template generation (that is -ai).

matchers:
  - type: llm
    part: body
    prompt: "Does this expose a stack trace with internal file paths?"
    expect: "yes"
    min-confidence: 0.8
extractors:
  - type: llm
    part: body
    prompt: "Extract product and version."
    schema: { product: string, version: string }

options restricts the verdict to a fixed set; inputs takes bodies from several requests (semantic diff). Provider/cache/budget via the shared layer, opt-in -llm flag, local model default.

Constraints: input is attacker-controlled, so enum output and delimiting; local default, banner names remote endpoints; not the sole matcher on high/critical without override; failures resolve to unverified, never a match; model, prompt hash, verdict, confidence in the JSON output.

Depends on projectdiscovery/utils#773 and projectdiscovery/dsl#332.