add: [malwagon] Malwagon sandbox lookup and submit expansion modules

[projectboot]

Adds two expansion modules for Malwagon, an online
malware-analysis sandbox that detonates a file or a URL on instrumented Windows
and Linux virtual machines.

Disclosure: I work on Malwagon, so this is a vendor-submitted module.

Two modules rather than one, deliberately. malwagon is expansion and
hover; malwagon_submit is expansion only. A hover module fires merely
because an analyst is looking at an attribute. A hash lookup is free, instant
and sends only a digest, so it is safe there. A detonation costs minutes, spends
one of a small number of hourly submits, and ships the sample to a third party,
so it must never be triggerable by hovering, and module-type is per module.
This follows the existing assemblyline_query / assemblyline_submit pair.
_malwagon_api.py holds the shared client and is underscore-prefixed so module
discovery skips it, as _assemblyline_api.py is.

Behaviour worth knowing:

• The submit module looks the SHA256 up first and returns the existing analysis
  if the digest is known, spending no submit quota. always_submit forces a
  detonation.
• A malware-sample attribute arrives base64-encoded and zipped with the
  password infected; it is unwrapped before submission, and no error path
  ever echoes decoded sample bytes.
• A max_tlp gate (default tlp:amber) refuses to submit an attribute marked
  more restrictively.
• Verdicts map onto MISP's own vocabulary (misp:threat-level), not raw vendor
  strings, and remote tags are rendered as text rather than written into the
  instance's taxonomies.
• The API key travels in the Authorization header only, every request carries
  an explicit timeout, redirects are not followed, and a 429 honours
  Retry-After once rather than looping.

Free tier: an API key is issued without payment details, so the lookup
module is usable by anyone reading this list.

Verification. flake8 --extend-exclude=misp_modules/lib/,tests/,website/
is clean, poetry build succeeds, make generate_docs renders both modules,
and tests/test_malwagon.py passes 32 tests with every HTTP call mocked and no
API key required. The modules were additionally run against the live service:
the lookup returns a file object and a sandbox-report object carrying the
verdict, the score and a permalink.

No new dependency: requests and pymisp are already resolved.

[adulau]

I did a test with the service and it seems that the result is bizarre. If you submit a Linux ELF, it seems to run in a Windows env.

[projectboot]

Thanks for actually running it - that was a real bug and you found it in one try.

You were right about the symptom and it was worth chasing, because the routing
itself was fine: the dispatcher reads the ELF magic and picks the Linux sandbox.
What broke it was upstream of that. Our anonymous lane pinned an operating
system on every submission, and content detection only runs when nothing asked
for one. The pin was not arbitrary either - the anonymous tier allowed exactly
one image - so a Linux ELF was copied to a Windows desktop, renamed to .exe,
executed nothing, and the run came back empty.

Two changes: the anonymous tier now allows the Linux sandbox as well, and the
OS is derived from the sample's own bytes instead of being a constant. It is
still not something a submitter can choose - the derivation happens server side
and the plan allowlist still checks the result.

Your submission is on the same page, re-run: the file now lists both runs, the
Windows one from this morning and a Linux one, so you can see the difference
without taking our word for it.

https://malwagon.com/s/2392

One thing we are not claiming: the verdict did not change. Nothing matched in
static or in our hash feeds, and the anonymous tier is network isolated by
design - egress is paid only, because a controllable VM with a route out is a
machine somebody else can commit crimes from - so a network-driven Linux sample
has little to do in it and the behaviour is thin either way. That is a
deliberate limit rather than the thing you found, and we would rather say so
than let a fixed OS label read as a fixed verdict.

Happy to hold the PR until you are satisfied it behaves.