classify CloudFront distributions

Custom domains commonly CNAME to <dist>.cloudfront.net, so CDN-hosted static
sites were invisible to CNAME discovery. Classify them as AWS/WebApp and probe
https://<dist>.cloudfront.net/ for readability.

internal/classify/aws.go

@@ -17,6 +17,23 @@ func aws(p model.Provider, s model.Service, sem model.PublicSemantic, resource,
 	}
 }
 
+// classifyCloudFront matches <distribution>.cloudfront.net. Custom domains
+// almost always CNAME to a CloudFront distribution, so this is how CDN-hosted
+// static sites get discovered via DNS enrichment.
+func classifyCloudFront(s *scanner) (model.Match, bool) {
+	n := s.n
+	if n != 3 || s.label(n-1) != "net" || s.label(n-2) != "cloudfront" {
+		return model.Match{}, false
+	}
+	return model.Match{
+		Provider:         model.ProviderAWS,
+		Service:          model.ServiceWebApp,
+		ResourceSpecific: true,
+		PublicSemantic:   model.PublicSemanticPublicEndpoint,
+		Resource:         s.label(0),
+	}, true
+}
+
 func classifyAWS(s *scanner) (model.Match, bool) {
 	n := s.n
 	if n < 4 || s.label(n-1) != "com" || s.label(n-2) != "amazonaws" {