[AlyaGomaa]

Sub-PR of #2141: part 5 of 12. The parent PR stays open and unchanged; this PR carries one feature of it so it can be reviewed on its own.

What this PR adds

• Whitelist file: IP + destination port rules, source IP conditions, AirPlay request URI rules and a blocking ignore type that keeps evidence and alerts but exempts the host from blocking and ARP poisoning.
• Each run loads its local whitelist; comments are kept; Zeek log cleanup no longer deletes the configured whitelist.
• Organization whitelist: subdomain matching fixed.
• Prevention on macOS through pf (macos_pf.py); no firewall privilege prompt on shutdown when nothing was blocked.
• Feed status (feed_status.py): sources, update dates and indicator counts; empty feeds and Redis errors are handled.

Where it sits in the split

• Chain: part 5 of 12. Review and merge in order.
• Base: sebas/feat/instance_lifecycle_commands (Add commands to stop, restart and view Slips instances #2201), so the diff shows only this PR's changes. GitHub retargets it to develop when Add commands to stop, restart and view Slips instances #2201 merges.
• Next: Rework ARP and port scan detection with bounded tracking #2203.
• Size: 57 files, +3914 / -417 lines (tests are +2041 of them).
• Built from parent head 8d6533186.

Tests

• Unit suite on this branch (local, pytest tests/unit -n 3): 4180 passed, 2 skipped, 2 failed. Failing: test_native_restart_preserves_arguments_and_waits_for_worker. They fail the same way on the unsplit parent branch in the same local sandbox. Integration tests were not run locally.