[bug] Fix key material node collision across accounts with empty Identifier (#7)

[p0dalirius]

Linked Issue

Closes #7

Root Cause

ParseResults already handled an empty kc.Identifier for the KeyCredential node by falling back to a unique id derived from the owning account ("Unknown-<n>." + distinguishedName, see parse.go:52–57). The matching code path for the KeyMaterial node at parse.go:163 did not have this fallback:

keyNodeId := kc.Identifier + "." + nodeKind

When kc.Identifier == "", every key material of a given type collapsed onto the same id (".KeyCredentialRSAPublicKey", etc.). The next line then reuses any existing node with that id, so every unrelated account producing an empty-Identifier credential of the same key type ended up wired (via HasKeyMaterial) to the single first node. The README's "shared key material" Cypher query therefore reported false positives for these credentials.

Fix Description

Use the same fallback shape as the KeyCredential branch: when kc.Identifier is empty, derive keyNodeId from the credential-scoped keyCredentialNodeId (which already encodes the owning DN) rather than the global identifier. The non-empty path is unchanged so legitimate sharing of key material across accounts — when two credentials genuinely have the same Identifier — continues to produce a single shared node, as the README's Cypher query intends.

How Verified

Static: the patched parse.go:163–168 mirrors the empty-Identifier handling at parse.go:52–57, so:

• Non-empty kc.Identifier: keyNodeId == kc.Identifier + "." + nodeKind (unchanged).
• Empty kc.Identifier: keyNodeId == keyCredentialNodeId + "." + nodeKind == "Unknown-<idx>." + distinguishedName + "." + nodeKind, which is unique per credential per account.
  Runtime: go build -o KeyCredentialHound . builds cleanly; help output unchanged; the binary's runtime path up to the LDAP step is unaffected.

Test Coverage

None: the repository has no Go test suite. The change is a small, deterministic adjustment to a single string construction; the static analysis above covers both branches.

Scope of Change

• Files changed: parse.go
• Submodule pointer updated: no
• Behavioral changes outside the bug fix: none

Risk and Rollout

Local to ParseResults. The only behavioral difference is that empty-Identifier key materials are no longer merged. Existing exported graphs from previous versions may show fewer false HasKeyMaterial overlaps after re-running the collector; consumers re-running their saved Cypher queries should see fewer spurious shared-key-material findings.