fix(filters): CrowdStrike normalization and rule contracts

[rvald26]

Problem and behavior

Preserve explicit SourceIp over LocalIP, normalize addresses/outcomes and correct alert grouping.

This draft contains CrowdStrike only: 1 filter changes and 8 correlation-rule changes, plus its own review notes and regression manifest. Reviewed 1 filter configurations and all 17 matching shipped rules; unchanged rules remain outside the diff.

Verification

• Exact standard names/types were checked against the supplied UTMStack dictionaries and go-sdk v1.1.31. Pipeline/rename semantics, afterEvents, custom log.* fields and alert-side grouping follow the SDK wiki.
• Strict SDK decoding, explicit output/search/grouping field checks and actual CEL compilation pass for this technology.
• 2 synthetic normalization cases pass with final SDK Event conversion and the trigger assertions listed in the manifest.
• This independent branch passes the scoped alerts-module tests with the shared runner temporarily applied; git diff --check passes.
• The combined local integration of all technology fixes passes the full 36-filter/635-rule contract suite and 172 normalization cases.

Read filters/audits/crowdstrike.md for scope and source-specific qualifications. Fixtures: plugins/alerts/testdata/filter-contracts/crowdstrike.json.

Dependencies and validation limits

Shared test runner: #2590. Apply it before relying on go test ./... in plugins/alerts to execute this JSON manifest.

Runtime dependency: #2590 is also required for the changed lastEvent.* grouping fields to resolve correctly.

Tests start with synthetic extraction results and model normalization, using the real SDK CEL/protobuf. Complex raw-log extraction, dynamic plugins and historical OpenSearch alert generation still need staging validation. This is not a measured reduction in customer alert volume. Review custom rules that consume legacy outcome/severity values before any rollout.

Base: utmstack/UTMStack v11. Leave as draft for team review. No merge, auto-merge, or production deployment. Split from the audit in #2589.