Improve virus scan performance with clamdscan

[douz]

Summary

• install clamav-daemon alongside the existing ClamAV packages
• run a short-lived, isolated clamd instance for each virus scan
• use clamdscan --multiscan to parallelize directory scanning
• preserve the existing cache exclusions and exit behavior
• add focused regression coverage for clean, infected, startup-error, and scan-error paths

Behavior

• clean scan: exits 0
• infection found: exits 1
• scanner or daemon error: exits 0 to preserve the existing fail-open deploy behavior
• .composer-cache and node_modules_cache remain excluded

Testing

• bash tests/test-virus-scan.sh
• bash -n scripts/virus-scan tests/test-virus-scan.sh
• shellcheck scripts/virus-scan tests/test-virus-scan.sh
• PHP 8.4 Bookworm image build
• real container scans for clean, EICAR, excluded EICAR, and invalid database paths

Ticket: TENUPSYS-3848