Allow alert from unexpected Ports, allow Port=0 as intentional wildcard

[entlein]

Still need to talk to myself if !event.dstAddr.startsWith('127.') is a good default, cause a lot of attacks to come from 127.0.0.1 .
Thoughts are: here in the test suite we exclude 127 , as port-fwds or proxies often cause noise during testing
But we exclude it in the rulelibrary default -> this needs a good set of realistic apps on clusters to decide.

This PR is assumed stacked onto #902

Why I think we should have the code (w/o defaults discussion)

We are carrying the port/protocol stanza pretty much everywhere, but the ports no matching is currently a dud (it doesnt alert).
If we find that it doesnt impact performance, it would align better with the expectations (if there is a stanza in a profile, it should either do something or be removed)

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 379ace8e-2b6d-4fe5-b934-439233fe8d84

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}