[AlyaGomaa]

Sub-PR of #2141: part 10 of 12. The parent PR stays open and unchanged; this PR carries one feature of it so it can be reviewed on its own.

What this PR adds

• Connections: broadcast, group and ICMP traffic excluded from long-connection findings; TCP handshake evidence avoids reversed connection findings; port 80 traffic is checked against linked HTTP records first.
• Private subnet mismatch: one finding per flow, high for the source host and info for the receiving host; subnet checks use the network at capture time.
• DNS: DGA counts distinct failures; working resolvers and local discovery are excluded from missing-resolution evidence.
• TLS/HTTP: suspected TLS provider impersonation, HTTP IP hosts, binary content header anomalies, executable downloads raised to medium.
• SSH password guessing requires authentication failures; Windows NT is no longer matched inside Macintosh user agents.
• Evidence descriptions state observed facts without recurring disclaimers.

Where it sits in the split

• Chain: part 10 of 12. Review and merge in order.
• Base: sebas/feat/service_anomaly_detection (Add service anomaly detection #2206), so the diff shows only this PR's changes. GitHub retargets it to develop when Add service anomaly detection #2206 merges.
• Next: Validate P2P reports and add network catch-up #2208.
• Size: 40 files, +4888 / -759 lines (tests are +2896 of them).
• Built from parent head 8d6533186.

Tests

• Unit suite on this branch (local, pytest tests/unit -n 3): 5168 passed, 2 skipped, 2 failed. Failing: test_native_restart_preserves_arguments_and_waits_for_worker. They fail the same way on the unsplit parent branch in the same local sandbox. Integration tests were not run locally.