VACO: Configurable Agent Orchestration for Static Web Vulnerability Assessment