feat: Event normalization — common schema projection for all sources

[jmrGrav]

Context

Each source emits different schemas. Before timeline aggregation is possible, each source must be projected onto the common SecurityEvent schema.

Goal

Implement Normalize(raw interface{}, source EventSource) (SecurityEvent, error) for each source adapter.

Sources

• CrowdSec LAPI decision → SecurityEvent
• Cloudflare WAF event → SecurityEvent
• Nginx access log entry → SecurityEvent
• AbuseIPDB report → SecurityEvent (enrichment only)
• Operator action (ban/note/suppress) → SecurityEvent

Acceptance criteria

• All fields populated where source provides them
• Fields absent in source set to zero value (not nil pointer unless optional)
• Source field always set
• Round-trip test: normalize → serialize → deserialize → equal