Added KeychainsItems Support for MacOS

[Gear-I]

Summary

• Adds `scripts/artifacts/keychains.py`, three new artifacts under category "Keychains (macOS)": Generic Passwords and Internet Passwords (classic `*.keychain-db` format), and Local Items (`keychain-2.db`, the modern per-user SQLite-backed keychain).

What it recovers

• Item metadata only: creation/modification time, label, account, service/server, protocol/port/path, access group, comment. The password/secret itself is never decrypted -- flagged present/size instead, since decrypting the classic format needs the user's login password and the local items format is Secure Enclave-protected.
• A hand-written parser for Apple's undocumented 'kych' binary format, since `keychain-db` isn't SQLite. Checked byte-for-byte against a real macOS Big Sur test image (Josh Hickman / thisisdfir, acquired 2021-02-20) using chainbreaker as an independent reference parser -- every field matched exactly across all 16 real generic password records recovered.
• A validated SHA-1 dictionary match for keychain-2.db's hashed acct/svce/labl columns: candidates are pulled only from other evidence already present in the same extraction (access-group names, plaintext values recovered from the classic keychain files), so every resolved value is traceable back to real evidence in the case rather than an external wordlist. Resolved 128 of 327 local-items rows on the validation image, including confirming the account's real Apple ID on several iCloud-related items.

Code was Co-Authored by Claude Sonnet 5