Add Modbus TCP protocol analyzer

[Zious11]

Summary

Implement a Modbus TCP analyzer for ICS/OT network forensics.

Requirements

• Detect Modbus TCP on port 502
• Parse MBAP header (transaction ID, protocol ID, length, unit ID)
• Parse function codes: Read Coils (0x01), Read Holding Registers (0x03), Write Single Coil (0x05), Write Multiple Registers (0x10), etc.
• Track write operations as higher-risk events
• Detect anomalies: unusual function codes (diagnostic 0x08, restart 0x08/0x01), rapid write bursts, exception responses
• Map to MITRE ICS: T0855 (Unauthorized Command Message), T0836 (Modify Parameter)

Acceptance Criteria

• `ModbusAnalyzer` implements `ProtocolAnalyzer`
• Tests with crafted Modbus TCP packets
• Summarize: function code distribution, write counts, exception counts
• Findings for suspicious write patterns and unusual function codes