Skip wave-attack detection for bypassed requests

[bitterpanda63]

Summary

Two related fixes for the wave-attack detector:

1. Defensive bypass check. `is_attack_wave` now returns False when `BypassedContextStore.is_bypassed()` is set. Callers should normally never reach here for bypassed requests (the framework entry point clears the context), but this keeps wave detection consistent with all other per-request blocking sites.

2. Regression test for sample collection. 16 requests with distinct query strings should produce 15 unique samples — but `context.url` previously stripped the query string, collapsing them all into 1 sample. Test added to lock in the post-fix behavior.

Tests fixed in QA suite

• `test_wave_attack` — both failing assertions:
  • "Expected 15 samples, got 1" (fixed by Include query string in URL for ASGI/WSGI requests #622's URL query-string preservation).
  • "Expected 0 attack wave events with bypass IP 2.16.53.10" (fixed by Skip context creation for bypassed IPs #623's BypassedContextStore wiring; this PR adds the defensive in-detector check).

Dependencies

This PR's QA gate passes only after both dependencies merge:

• Include query string in URL for ASGI/WSGI requests #622 — URL query string preservation
• Skip context creation for bypassed IPs #623 — BypassedContextStore + skip-context-for-bypassed-IPs

The detector code change here is independent of either, but the QA test re-enable will fail until both land.

Test plan

• New unit test: 16 unique-query-string requests produce 15 distinct samples.
• New unit test: bypass flag set → `is_attack_wave` returns False and never collects samples.
• Full unit suite passes locally.
• QA suite: verify `test_wave_attack` passes once both deps merge.

Merge notes

• Includes `aikido_zen/storage/bypassed_context_store.py` and its test (identical to the file in Skip context creation for bypassed IPs #623). When both merge, the file content is the same — git will report no conflict.
• Conflicts with the `skip_tests:` line in `.github/workflows/qa-tests.yml` are expected — resolve by keeping the union of removals.

🤖 Generated with Claude Code

Summary by Aikido

Security Issues: 0	Quality Issues: 0	Resolved Issues: 0

🚀 New Features

• Added bypassed_context_store to record per-request bypass status using contextvars

⚡ Enhancements

• Preserved URL query strings for ASGI and WSGI request builders
• Removed wave_attack and path_traversal from QA skip list

🐛 Bugfixes

• Skipped wave-attack detection for bypassed requests and prevented sample collection

^{More info}