Add IP-layer byte counts (ip_bytes, ip_bytes_in, ip_bytes_out) to network_traffic

[flying-coyote]

Summary

The Network Traffic object's bytes / bytes_in / bytes_out are defined in the dictionary as payload byte counts (bytes_in = "bytes sent from the destination to the source"). There is no attribute for the IP-layer byte count — payload plus the IP and transport (TCP/UDP) headers — which common network sensors emit as a distinct value.

The most widely deployed open network sensor, Zeek, reports both for every connection in conn.log:

• orig_bytes / resp_bytes — payload bytes
• orig_ip_bytes / resp_ip_bytes — IP-layer bytes (header-inclusive)

Today a producer mapping Zeek (or any sensor with IP-layer counters) must either drop the IP-layer count or overload bytes_* with it, which silently breaks any consumer that assumes bytes_* is payload, and makes the two byte models non-comparable across producers.

Change

Adds three attributes to objects/network_traffic.json (and the dictionary), mirroring the existing payload trio so the object stays symmetric:

New attribute	Maps (Zeek conn.log)	Meaning
ip_bytes_out	orig_ip_bytes	IP-layer bytes source → destination (outbound), headers included
ip_bytes_in	resp_ip_bytes	IP-layer bytes destination → source (inbound), headers included
ip_bytes	sum	total IP-layer bytes, both directions

• Direction convention matches the existing bytes_in / bytes_out (in = destination → source, out = source → destination).
• All three are long_t, requirement: optional.
• Descriptions explicitly state the distinction from the payload bytes_* so the difference is unambiguous in the rendered schema.

Precedent

Follows #1316, which added the Zeek-derived history and missing_bytes attributes to the same object — this fills the remaining IP-byte gap on that path.