[AlyaGomaa]

Sub-PR of #2141: part 6 of 12. The parent PR stays open and unchanged; this PR carries one feature of it so it can be reviewed on its own.

What this PR adds

• ARP: new scan detector with history and settings (modules/arp/scan_detector.py, scan_history.py, scan_settings.py); neighbour discovery is separated from scan-like searches.
• Port scans: horizontal and vertical detectors rewritten (modules/network_discovery/scan_detector.py, vertical_detector.py); stale sessions are not counted; established unknown services stay visible after a scan.
• Confirmed-scan tracking is bounded and progress is reported on a logarithmic schedule (common/scan_progress.py).
• New arp and network_discovery sections in config/slips.yaml; docs for ARP scans, horizontal port scans and scan progress.

Where it sits in the split

• Chain: part 6 of 12. Review and merge in order.
• Base: sebas/feat/scoped_whitelist_blocking (Add scoped whitelist rules and macOS blocking #2202), so the diff shows only this PR's changes. GitHub retargets it to develop when Add scoped whitelist rules and macOS blocking #2202 merges.
• Next: Add beaconing detection and repair RNN C2 processing #2204.
• Size: 42 files, +6173 / -1212 lines (tests are +2364 of them).
• Built from parent head 8d6533186.

Notes for review

• slips_files/common/flow_direction.py and its tests arrive here because the port scan detector is its first user in the chain; the beaconing, service anomaly and detector-fix parts use it too.

Tests

• Unit suite on this branch (local, pytest tests/unit -n 3): 4403 passed, 2 skipped, 2 failed. Failing: test_native_restart_preserves_arguments_and_waits_for_worker. They fail the same way on the unsplit parent branch in the same local sandbox. Integration tests were not run locally.