Findings schema currently allows arbitrary top-level properties (additionalProperties: true) in parser-sdk/nodejs/findings-schema.json / documentation/docs/api/finding.md, and the Go hook-sdk (hook-sdk/golang/files.go) doesn't reject unknown JSON fields when decoding findings either.

This was kept permissive in #3786 because zap-automation-framework and ssh-audit parsers emit non-standard top-level fields (hint, port) instead of nesting them under attributes.

To do:

• Move hint (zap-automation-framework) and port (ssh-audit) into attributes
• Set additionalProperties: false in both schema files
• Re-enable decoder.DisallowUnknownFields() in hook-sdk/golang/files.go
• Test and ensure that the nodejs & golang sdk's are properly validating it

This is a breaking change for any parser emitting non-standard top-level finding fields, so it should ship with a major/breaking release.