[AlyaGomaa]

Sub-PR of #2141: part 7 of 12. The parent PR stays open and unchanged; this PR carries one feature of it so it can be reviewed on its own.

What this PR adds

• beaconing module: bounded numeric beaconing detection from timing, sizes and duration, with info periodicity findings and low suspected-C2 findings.
• Sparse packet heartbeats inside long-lived TCP connections (packet-timing.zeek, packet_timing flows, packet_flows.py).
• RNN C2 detector: preprocessing repaired, grouped training.
• Training and evaluation tools (tools/beaconing), shipped model (model.json).
• Docs: beaconing.md (configuration, validation, false candidates, missed C2 examples), cc_detection_strategy.md, packet_timing.md.

Where it sits in the split

• Chain: part 7 of 12. Review and merge in order.
• Base: sebas/feat/bounded_scan_detectors (Rework ARP and port scan detection with bounded tracking #2203), so the diff shows only this PR's changes. GitHub retargets it to develop when Rework ARP and port scan detection with bounded tracking #2203 merges.
• Next: Add SMB behavior detection #2205.
• Size: 57 files, +7583 / -528 lines (tests are +1283 of them).
• Built from parent head 8d6533186.

Notes for review

• slips_files/common/anomaly_detection.py arrives here because beaconing is its first user in the chain; its tests come with the service anomaly part, which they exercise.

Tests

• Unit suite on this branch (local, pytest tests/unit -n 3): 4562 passed, 2 skipped, 2 failed. Failing: test_native_restart_preserves_arguments_and_waits_for_worker. They fail the same way on the unsplit parent branch in the same local sandbox. Integration tests were not run locally.