Add option to disable negative signatures

[liquidsec]

Summary

• Adds --disable-negative-signatures CLI flag and matching disable_negative_signatures kwarg on BadDNS_base so callers (CLI, BBOT) can opt out of negative-signature suppression in the CNAME and NS modules. When set, generic dangling CNAME/NS findings fire even for known non-exploitable services (Cloudflare, Akamai, etc).
• Fixes a latent test regression from commit 137561f: under pyfakefs, tldextract's suffix-list fetch raised OSError (certifi cacert hidden) which it doesn't catch, so the snapshot fallback never ran. An autouse conftest fixture now exposes the real cacert to the fake fs so the fetch fails as a RequestException and tldextract uses its bundled snapshot.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (96ed35e) to head (0ba6c0b).

Additional details and impacted files

@@            Coverage Diff            @@
##               dev      #891   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           26        26           
  Lines         1924      1927    +3     
=========================================
+ Hits          1924      1927    +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[liquidsec]

@SpamFaux as requested. Will ship in 2.4