fix(bitdefender): correct CEF mappings and scoped detections

[rvald26]

Bitdefender CEF records marked blocked phishing, port scans and incidents as successful, and incident src values could replace the managed endpoint address. This draft repairs the raw-field producer and all 21 consumers against go-sdk v1.1.31 and the official wiki.

• Parse bounded CEF envelopes, preserve space-bearing vendor fields, and prevent escaped keys or extension text from inventing classifications and addresses.
• Validate original IPs, preserve explicit attacker/victim roles, and use the stable computer identifier with distinct fallback namespaces. Keep ambiguous incident src/spt values under log.
• Map explicit blocks to denied, scope remediation/task results to their actual action, and keep report-only/ignored/no-action outcomes unknown. Correct infected-object versus malware-type semantics and add safe file/process/account/domain/hash/protocol mappings.
• Scope all five histories to exact candidates, collector/company and appropriate actor/endpoint identity. Normal task traffic and ordinary device-control blocks no longer count as malicious activity. Descriptions no longer equate detection with compromise or report-only phishing with credential exposure.

Validation: 80 synthetic raw CEF cases, positive/negative predicates for all 21 rules, five real-SDK mock-history suites, and a private replay of 35 bounded records from three instances. The shared-runner overlay passes 112 test/subtest records with no failures or skips. The replay preserves all module values, corrects three endpoint addresses and maps 24 explicit blocks to denied. Predicate candidates are not observed alerts or measured false-positive rates. Privacy scanning found no sampled identifying literals in the 27 changed files.

Limits: the documented pipeline lacks general CEF unescaping. Encoded Windows directories/commands and partial URLs remain in original vendor fields; safe basenames and request domains still map. The available vendor page documents JSON semantics rather than a complete CEF mapping table. Unobserved classes, closed-runtime behavior, parser cost and alert-volume effects need staging. New history fields require up to 24 hours of warm-up. Details and migration notes are in filters/audits/bitdefender.md.

Filter and rules must ship together. Shared indexed-lastEvent grouping support is a separate dependency and fleet-wide rollout in #2627. No customer writes, deployment, merge or auto-merge is included.

Fresh draft review submission requested after review of #2591. That earlier PR is retained as historical context and was not modified by this publication. This PR targets the official utmstack/UTMStack:v11; it is not approved for merge.

A final endpoint-role check keeps reporting-device host/domain/user metadata off unrelated victim addresses. Explicit attacker/victim addresses remain authoritative; local-port mapping requires the reporting endpoint to be the victim. Three additional raw controls cover this boundary.