[AlyaGomaa]

Sub-PR of #2141: part 9 of 12. The parent PR stays open and unchanged; this PR carries one feature of it so it can be reviewed on its own.

What this PR adds

• Optional anomaly_detection_services module: newly answering local ports after host training, unfamiliar clients of a learned service, unusual connection hours, unusually short or long completed TCP connections.
• Builds on the shared anomaly statistics from the beaconing part; fast warm-up configuration, capacity of 4096 services.
• HTTPS anomaly detector: upload checks limited to their period, rotated logs, concise observations with readable baselines.
• Every service and HTTPS anomaly setting is explained next to its value in config/slips.yaml.

Where it sits in the split

• Chain: part 9 of 12. Review and merge in order.
• Base: sebas/feat/smb_behavior_detection (Add SMB behavior detection #2205), so the diff shows only this PR's changes. GitHub retargets it to develop when Add SMB behavior detection #2205 merges.
• Next: Fix false positives in existing detectors #2207.
• Size: 29 files, +4624 / -213 lines (tests are +1943 of them).
• Built from parent head 8d6533186.

Tests

• Unit suite on this branch (local, pytest tests/unit -n 3): 4795 passed, 2 skipped, 2 failed. Failing: test_native_restart_preserves_arguments_and_waits_for_worker. They fail the same way on the unsplit parent branch in the same local sandbox. Integration tests were not run locally.