CDN/WAF ports should be filtered by default #3545

CDNs and WAFs like Cloudflare answer on a dozen or so ports (2052-2096, 8080, 8443, 8880) on every IP, so port sources like shodan_idb report all of them as open for every host behind them. Almost none of them lead anywhere, but each one becomes an OPEN_TCP_PORT, gets probed by http, and produces junk URLs. On a typical subdomain-enum scan, the large majority of shodan_idb's open ports can be non-80/443 ports on CDN/WAF-tagged hosts.

The portfilter module already drops these, but it's opt-in (--exclude-cdn or a handful of presets), so most scans don't use it and pay the cost.

Proposed Behavior

• Make CDN/WAF port filtering core scan behavior, on by default: drop OPEN_TCP_PORT, URL_UNVERIFIED and URL events on hosts tagged cdn or waf unless the port is 80 or 443.
• Never filter ports the user explicitly targets (e.g. -t host:8443).
• Provide an opt-out flag to restore the current behavior.
• Since the filter would no longer be a separate opt-in step, remove the portfilter module and --exclude-cdn.