fix(fortigate): preserve parsed identities and scope security detections

[rvald26]

FortiGate KV parsing truncates quoted messages and identity fields, and explicit SSL-VPN login failures carry remip while their rule expects origin.ip. Several security rules also read mismatched fields or count unrelated history. This draft corrects the filter and six rules together; the seventh rule is covered without a rule edit.

• Recover complete consumed fields at real KV boundaries. Anchor PRI/CEF headers and prevent quoted message text from supplying IPs or actions.
• Validate vendor IPs before promotion, preserve invalid vendor values, and retain physical source/destination roles. Add verified host, OS, MAC, authentication, URL and domain mappings.
• Use event context for outcomes: explicit denial overrides acceptance; failed-connection DNS records remain failures, while ordinary DNS actions do not imply failure.
• Restrict SSL brute force to authentication failures, IPS/DLP/antivirus history to relevant candidates, and histories/grouping to the appropriate appliance, VDOM and actor. Exclude local IPv6 admin logins from the external-source heuristic.

Validation passed with SDK v1.1.31: 72 synthetic raw fixtures covering all seven predicates, five SDK history-query tests against an isolated localhost mock, and the shared contract-runner overlay. Bounded comparisons and modeled replay used 63 private records from three instances. Existing network fields were preserved; the model recovered 40 messages, 13 descriptions and six SSL peer IPs. Predicate results were one admin candidate, six SSL failures and one critical denied IPS event. These are not generated customer alerts or proof that live thresholds were met.

See filters/audits/fortigate.md for evidence, official references and limits. The closed filter executor and arbitrary CEF variants remain staging checks. Recovery adds parsing work, so measure throughput and alert volumes before production. The nanosecond vendor timestamp is retained until a supported conversion is verified; NAT and file-type fields are not given invented standard meanings.

Deploy filter/rules together and allow the 15-minute/one-hour histories to warm up. Appliance/VDOM lastEvent.* grouping depends on the separately reviewed foundation #2590. Review saved-query compatibility with the explicit outcome vocabulary. This remains a draft against utmstack/UTMStack:v11; no customer configuration or production deployment was changed.