✨ tests: end-to-end suite scaffold + stream-mode scenario

Add tests/e2e/ structure with shared bash helpers and the first
scenario (stream-mode): spin up real Traefik + Crowdsec via docker
compose, mount the repo as a local plugin, add a ban via cscli, verify
the bouncer blocks the matching X-Forwarded-For, then delete the
decision and verify pass-through.

Adds .github/workflows/e2e.yml with one matrix job per scenario
(stream-mode for now), and Makefile targets `e2e` and `e2e_<scenario>`
for local runs.

Refs #328

tests/e2e/scenarios/stream-mode/traefik-dynamic.yml

@@ -0,0 +1,22 @@
+http:
+  routers:
+    whoami:
+      rule: "PathPrefix(`/foo`)"
+      entryPoints: [web]
+      service: whoami
+      middlewares: [bouncer]
+  services:
+    whoami:
+      loadBalancer:
+        servers:
+          - url: "http://whoami:80"
+  middlewares:
+    bouncer:
+      plugin:
+        bouncer:
+          enabled: true
+          crowdsecMode: stream
+          updateIntervalSeconds: 3
+          crowdsecLapiKey: "40796d93c2958f9e58345514e67740e5"
+          forwardedHeadersTrustedIPs:
+            - "172.16.0.0/12"