Msadministrator.feat.pdf password

[MSAdministrator]

Describe the change

Adds support for passing a per-request password to decrypt password-protected PDFs during scanning. This is implemented as a general-purpose metadata passthrough mechanism that any scanner can use for per-request parameters.

Changes across 4 layers

1. Go Frontend (src/go/cmd/strelka-frontend/main.go): Stores Attributes.metadata from the gRPC request into Redis as metadata:{id} using SetNX, following the same pattern as YARA data. This makes client-provided metadata available to the backend.

2. Python Backend (src/python/bin/strelka-backend): Reads metadata:{root_id} from Redis in distribute() and injects it into each scanner's options as options['metadata']. Kept as a nested key to prevent client-supplied values from overriding config-based scanner options.

3. ScanPdf Scanner (src/python/strelka/scanners/scan_pdf.py): Reads password from options['metadata'] and uses fitz.authenticate(password) to decrypt encrypted PDFs. Adds three new flags:

   • decrypted_with_password — PDF was encrypted and successfully decrypted
   • password_auth_failed — password was provided but incorrect
   • encrypted_pdf_no_password — PDF is encrypted but no password was provided (replaces the previous generic pdf_load_error)

4. Python Client (misc/python-client/client.py): Adds -p/--password CLI flag that populates Attributes.metadata["password"] in the gRPC request.

No proto changes required — Attributes.metadata (map<string, string>) was already defined in the protobuf but unused until now. No generated code changes needed.

Dependencies: None. The Attributes.metadata field and fitz.authenticate() (PyMuPDF) are both pre-existing capabilities that were not previously wired together.

Describe testing procedures

12 unit tests added in src/python/strelka/tests/test_scan_pdf.py covering all password scenarios:

PYTHONPATH=src/python uv run pytest src/python/strelka/tests/test_scan_pdf.py -v

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of and tested my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings