provide configuration options for pulling from threat intel feeds

[mmguero]

Provide configuration options for pulling from threat intel feeds so the user doesn't have to manually edit the environment variables:

New questions in the ./scripts/configure script:

• Configure pulling from threat intelligence feeds for Zeek intelligence framework?
  • Answer Y to configure pulling from threat intelligence feeds to populate the Zeek intelligence framework. Answer N to leave settings for pulling from threat intelligence feeds unmodified.
  • Pull from threat intelligence feeds on startup?
    • Answer Y for Malcolm to pull from threat intelligence feeds when the zeek-offline container starts up.
  • Cron expression for scheduled pulls from threat intelligence feeds
    • Specifies a cron expression (using cronexpr-compatible syntax) indicating the refresh interval for generating the Zeek Intelligence Framework files.
  • Threat indicator "since" period
    • When querying a TAXII, MISP, or Mandiant threat intelligence feed, only process threat indicators created or modified since the time represented by this value; it may be either a fixed date/time (01/01/2025) or relative interval (7 days ago).
  • Intel::item_expiration timeout for intelligence items (-1min to disable)
    • Specifies the value for Zeek's Intel::item_expiration timeout as used by the Zeek Intelligence Framework (default -1min, which disables item expiration).

After configuring these options, the user is told where to place the feed definitions (which are not prompted as inputs here, at least not yet, as they can be rather complicated).