Adds an opt-in "Last only" boolean argument (default false to preserve
existing behaviour) to the Defang IP Addresses operation. When enabled,
only the final separator of each matched IP is replaced:
- IPv4: 1.2.3.4 -> 1.2.3[.]4 (instead of 1[.]2[.]3[.]4)
- IPv6: 2001:0db8::1 -> 2001:0db8::[:]1
This matches the common SOC-tool default (e.g. Splunk) where the
defanged form stays visually close to the original while still
rendering the address invalid.
50a7613bfd