fix(secops): surface all indicator fields and metadata in get_ioc_matches

[dandye]

Fixes #264

Summary

Fixes the output formatting in get_ioc_matches (server/secops/secops_mcp/tools/ioc_matches.py) to ensure all IoC indicators and critical threat intelligence metadata fields are surfaced rather than dropped.

Root Cause

Previously, get_ioc_matches only extracted a single indicator field from artifactIndicator using a hardcoded ['domain', 'url', 'ip', 'hash'] loop break on the first match. If an IoC object contained multiple indicator dimensions or non-standard indicator keys (such as hash_sha256, hostname, or snake_case attributes from SDK objects), subsequent indicators were omitted. In addition, metadata fields such as firstSeenTime, lastSeenTime, category, severity, confidence, and associatedEntity were ignored.

Solution

1. Multi-Indicator Formatting: Iterates through all key/value pairs in artifactIndicator (or artifact_indicator), producing a clean formatted string of all indicators (e.g. domain=bad-domain.com, url=https://bad-domain.com/malware.exe).
2. Metadata Surfacing: Extracts and displays First Seen, Last Seen, Category, Severity, Confidence, and Associated Entity.
3. CamelCase & SnakeCase Compatibility: Supports both raw Chronicle API response shapes (firstSeenTime, iocCategory, etc.) and Python SDK model shapes (first_seen_time, ioc_category, etc.).
4. Unit Tests: Adds unit tests in server/secops/tests/test_secops_tools_unit.py covering multi-indicator formatting, snake_case normalization, and empty match handling.

Testing

• pytest server/secops/tests/test_secops_tools_unit.py (14 passed)