Add DNP3 protocol analyzer

[Zious11]

Summary

Implement a DNP3 (Distributed Network Protocol 3) analyzer for ICS/OT forensics.

Requirements

• Detect DNP3 on port 20000 (TCP/UDP)
• Parse DNP3 data link layer header (start bytes 0x0564, length, control, destination, source)
• Parse transport and application layer function codes
• Track: reads vs writes, direct operate commands, cold/warm restarts
• Detect anomalies: unauthorized control commands, broadcast messages, unsolicited responses
• Map to MITRE ICS: T0855, T0803 (Block Command Message)

Acceptance Criteria

• `Dnp3Analyzer` implements `ProtocolAnalyzer`
• Tests with crafted DNP3 packets
• Summarize: function code distribution, control operation counts
• Findings for unauthorized control operations