zaproxy headless / API

Drive ZAP from CI (Kali). Authorized testing only.

$ zap.sh -daemon -port 8090 -config api.disablekey=true
$ curl 'http://localhost:8090/JSON/spider/action/scan/?url=https://example.com'
$ zap-cli report -o report.html -f html