feat(surface): make attack surface first-class in the finding pipeline

tests/java_fixtures.rs

@@ -450,6 +450,7 @@ mod java_fixture_tests {
             evidence: Some(evidence),
             rank_score: None,
             rank_reason: None,
+            exposure: None,
             suppressed: false,
             suppression: None,
             triage_state: "open".to_string(),