fix(SocFrameworkProofPointTap): full XDM mapping + rename modeling rule off the marketplace id

[scottbrumley]

fix(SocFrameworkProofPointTap): full XDM mapping + rename modeling rule off the marketplace id

The shipped modeling rule mapped a single field. This replaces it with a full
XDM mapping and fixes three install-blocking defects found by single-variable
upload tests.

Modeling rule

• Rename: id ProofpointTAP_modeling_rule -> SOCFW_ProofpointTAP_v2_ModelingRule,
  name -> "SOC Proofpoint TAP v2 Modeling Rule", directory to match. The old id
  was byte-identical to the marketplace ProofpointTAP legacy rule id, so the two
  packs competed for one registration.
• Full mapping: recipients/cc as JSON array strings rather than scalars,
  attachments from messageParts, threat detail from threatsInfoMap rather than
  the top-level threatID/threatURL columns, sender IP dual-stack, delivery
  timestamp, session_context_id, target url.

Three defects that fail pack install with 101704 while the Data Model Rules
editor accepts them -- the install validator and the editor do not agree:

• json_extract_scalar_array() is rejected; use arraymap(json_extract_array()).
• xdm.email.attachment.* is scalar; assigning an array fails. Wrap in
  arraystring() as the marketplace rule does.
• xdm.email.from_name is not an XDM field: zero occurrences across all
  shipping content.

Schema

• messageTime/clickTime must be datetime, not string; messageParts and
  threatsInfoMap string, not json. Matches the marketplace schema. Added
  toAddresses, which the rule reads and the schema never declared.

Release notes

• ReleaseNotes/1.3.2.md -> 1_3_2.md; the SDK expects X_Y_Z.md.

Known open, not addressed here: xdm.alert.category is null pending an
enumeration of real classification values; source IP uses senderIP where the
prior rule used clickIP; alert status maps active to PENDING where the prior
rule used IN_REVIEW.

[scottbrumley]

Superseded — replacing with the XSIAM AI-generated modeling rule verbatim plus the schema type fix. The XQL rewrites in this PR were unnecessary; the install failures were caused by the schema, not the rule body.