Avoid remote service discovery by default

[ystkfujii]

Description

Currently, node-agent defaults API_URL to api.armosec.io and calls LoadServiceURLs():

node-agent/cmd/main.go

Lines 421 to 424 in 300b59e

	apiURL := os.Getenv("API_URL")
	if apiURL == "" {
	apiURL = "api.armosec.io"
	}

In LoadServiceURLs(), if services.json does not exist, node-agent performs remote service discovery:

As a result, node-agent may access a public endpoint even when the user has not explicitly configured remote service discovery.

It would be better to perform remote service discovery only when it is explicitly enabled or API_URL is configured.

This would make network behavior more predictable, especially in restricted-egress and air-gapped environments.

Expected behavior

Remote service discovery should be explicitly configurable.

For example:

{
  "sbomGenerationEnabled": true,
  "sbomFailureReportingEnabled": false
}

When sbomFailureReportingEnabled is false, node-agent should not call LoadServiceURLs() for SBOM failure reporting.

When it is true, node-agent may load service information from services.json or perform remote service discovery if necessary.