Add remaining detection-only lib defs from #17

[andrew]

Eight libraries from the original #17 list that didn't make the first pass, plus celery and tera which came out of the coverage audit.

• java/spring-security.toml — auth framework for Spring; method-level @secured, OAuth2 resource server, CSRF config
• java/velocity.toml — template engine; #set and $reference evaluation, CVE-2020-13936 class
• java/dom4j.toml — XML parser; SAXReader resolves external entities by default
• java/jdom.toml — XML parser; SAXBuilder resolves entities by default
• php/laravel-sanctum.toml — API token auth for Laravel; token scope bypass, SPA cookie auth misconfiguration
• node/cross-spawn.toml — process spawning; safer than child_process.exec but shell option exists
• node/busboy.toml — streaming file upload parser; filename from Content-Disposition is client-controlled
• python/fabric.toml — remote execution over SSH; Connection.run passes through shell
• python/celery.toml — task queue; uses pickle for task serialization by default, deserialization on consumer side. Detect via celery dependency. function:messaging + function:serialization taxonomy.
• rust/tera.toml — template engine; |safe filter bypasses escaping, no sandbox for template logic