Add GTI/VirusTotal enrichment helpers

[arielkr256]

Summary

• Adds panther_gti_helpers, a reusable enrichment helper for Google Threat Intelligence / VirusTotal lookup-table data (vt_iocs_iocstream), mirroring the existing panther_otx_helpers pattern (built on the shared LookupTableMatches base).
• LUT auto-detection is signature-based (looks for gti_url/last_analysis_stats on matched values) since the VT LUT name is user-customizable.
• Adds a companion Standard.GTI.MaliciousIndicator detection (created disabled/experimental) that flags events whose IP/domain/file-hash indicators match a malicious GTI/VT verdict.
• 37 new unit tests for the helper (global_helpers/global_helpers_test.py::TestGTIIntelligence) plus 5 redacted rule tests (3 positive, 2 negative).

Test plan

• make fmt && make lint && make test — all pass (1074 pat tests + global helper unit tests, 0 failures)
• pipenv run python -m unittest global_helpers.global_helpers_test.TestGTIIntelligence — 37/37 pass
• pipenv run panther_analysis_tool test --filter RuleID=Standard.GTI.MaliciousIndicator — 5/5 pass

THREAT-691

[cursor]

PR Summary

Medium Risk
Medium risk because this adds new threat-intelligence detection logic and changes matching behavior for GreyNoise/OTX multi-match enrichments. The new GTI rule is disabled and experimental, which limits immediate production impact.

Overview
Adds panther_gti_helpers for Google Threat Intelligence / VirusTotal lookup-table enrichment, including LUT auto-detection, verdict accessors, severity derivation, GTI links, alert context, and multi-match support.

Adds a disabled experimental Standard.GTI.MaliciousIndicator rule that alerts on malicious IPs, domains, and file hashes across common log types, with indexes and detection coverage updated to include it.

Also fixes list-shaped enrichment handling for GreyNoise and OTX: LUT auto-detection now recognizes multi-match entries, GreyNoise boolean fields no longer treat any non-empty list as true, and the GreyNoise malicious IP rule can alert when any matched classification is malicious or unknown.

^{Reviewed by Cursor Bugbot for commit b89e798. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1464b21. Configure here.}