feat: add PumbaLP/adguardhome-dot collection for DoT scanner detection

[PumbaLP]

Adds a parser and scenario to detect port 853 (DNS-over-TLS) scanners targeting AdGuard Home instances.

Port scanners that probe DoT without completing a proper TLS handshake cause repeated "connection reset by peer" errors in AdGuard Home logs. This collection extracts the remote IP from these errors and bans IPs that trigger 5+ resets within 10 minutes.

Components

• Parser PumbaLP/adguardhome-dot-errors: extracts remote_ip, log_type and service from AdGuard Home DoT error logs
• Scenario PumbaLP/adguardhome-dot-scan: leaky bucket, capacity 5, leakspeed 10m, grouped by source_ip
• Collection PumbaLP/adguardhome-dot: bundles both components

What it detects

Port scanners and probers that connect to port 853 (DoT) without completing a proper TLS handshake. These appear as repeated connection reset by peer errors in AdGuard Home logs.

What it does NOT detect

• DoQ (port 8853 or 853/udp) – no remote IP in logs
• Direct DoH (port 443) – no remote IP in logs
• DoH via Nginx reverse proxy – use crowdsecurity/nginx-logs instead

Testing

Two hubtests are included:

• adguardhome-dot-errors: validates parser extracts source_ip, log_type and service correctly
• adguardhome-dot-scan: validates scenario coverage with 6 events from same IP

Tested in production against AdGuard Home v0.107.x running in Docker.

Closes #1753

Checklist

• I have read the contributing guide
• I have tested my changes locally
• For new parsers or scenarios, tests have been added
• I have run the hub linter and no issues were reported (see contributing guide)
• Automated tests are passing
• AI was used to generate any/all content of this PR

[Copilot]

Pull request overview

Adds a new PumbaLP/adguardhome-dot collection (parser + scenario) that detects port scanners probing AdGuard Home's DNS-over-TLS port 853 by aggregating repeated connection reset by peer errors per source IP.

Changes:

• New s01 parser PumbaLP/adguardhome-dot-errors extracting source_ip, service and log_type from AdGuard Home DoT reset errors.
• New leaky scenario PumbaLP/adguardhome-dot-scan (capacity 5 / leakspeed 10m / blackhole 5m) plus the bundling collection.
• Two hubtests under .tests/adguardhome-dot-errors and .tests/adguardhome-dot-scan, but the scenario assert does not actually validate the overflow.

Reviewed changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
collections/PumbaLP/adguardhome-dot.yaml	New collection bundling the parser and scenario.
parsers/s01-parse/PumbaLP/adguardhome-dot-errors.yaml	New grok parser on Line.Raw extracting remote IP from DoT reset errors.
parsers/s01-parse/PumbaLP/adguardhome-dot-errors.md	Parser documentation; has an unterminated YAML code fence.
scenarios/PumbaLP/adguardhome-dot-scan.yaml	New leaky scenario on source_ip triggering after 5 resets in 10m.
scenarios/PumbaLP/adguardhome-dot-scan.md	Scenario documentation; starts with a stray ```markdown fence.
.tests/adguardhome-dot-errors/*	Hubtest validating parser extraction; log fixture uses a real public IP.
.tests/adguardhome-dot-scan/*	Hubtest meant to validate the scenario, but scenario.assert asserts zero results.