feat(tcf-vendors): GVL cache + vendor extraction + VVT mapping

Phase 1-2 of the closed quality loop:
- GVL cache (consent-tester/services/gvl_cache.py): downloads and caches
  IAB Global Vendor List with 24h TTL, resolves vendor IDs to names,
  purposes, policy URLs, retention, country
- Vendor extraction (consent_interceptor.py): extract_tcf_vendors()
  reads __tcfapi after accept phase, resolves via GVL
- Scan response: tcf_vendors field added to /scan endpoint
- VVT mapper (vendor_vvt_mapper.py): maps TCF vendors to VVT format
  with purpose labels, Rechtsgrundlage, Drittland detection
- Vendor cross-check (banner_cookie_cross_check.py): checks all TCF
  vendors against DSI text — missing vendors, undocumented transfers
- Compliance check integrates Step 3d: TCF vendors vs DSI

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

consent-tester/main.py

@@ -49,6 +49,7 @@ class ScanResponse(BaseModel):
     structured_checks: list = []
     completeness_pct: int = 0
     correctness_pct: int = 0
+    tcf_vendors: list = []  # Resolved TCF vendor list from GVL
 
 
 @app.get("/health")
@@ -102,6 +103,7 @@ async def scan_consent(req: ScanRequest):
         url=req.url,
         banner_detected=result.banner_detected,
         banner_provider=result.banner_provider,
+        tcf_vendors=result.tcf_vendors,
         phases=phases,
         summary={
             "critical": sum(1 for v in result.reject_violations if v.severity == "CRITICAL"),