[brkozer]

Fixes #609.

For backends without cidr_expression, SigmaCIDRExpression.expand() now also emits patterns for the uncompressed IPv6 text that Sysmon network events write (all eight groups, no leading zeros, no ::, e.g. 0:0:0:0:0:0:0:1 for ::1), unless the RFC 5952 patterns already cover it.

• The RFC 5952 patterns and their order are unchanged. The new patterns are only appended.
• _expand_ipv6_subnet_uncompressed handles a partially covered group the same way as _expand_ipv6_subnet ([medium] Fix over-broad IPv6 cidr wildcard expansion #563).
• Examples: ::1/128 → ['::1', '0:0:0:0:0:0:0:1'], 64:ff9b::/96 → ['64:ff9b::*', '64:ff9b:0:0:0:0:*']. fe80::/10, fc00::/7 and 2001:db8::/64 are unchanged.

Tests: exact expansions for the affected cases, plus a match test that checks addresses inside the network against both text forms and addresses outside it against both forms.

I also checked this outside the test suite:

• On 6,019 random and edge-case networks (prefixes 0–128), with about 1.9M address checks: every address inside the network matches in both forms. Every pattern from main is kept, in the same order. No added pattern matches an address outside the network.
• On SigmaHQ rules, the 55 IPv6 CIDR values grow from 92 to 111 patterns. Only /128s with :: gain one pattern.

black --check ., mypy and pytest pass. The only failures are the two test_plugins installation tests, which also fail on main here (no pip in my venv).

[brkozer]

The CI failure was a real bug that my local run missed, because I only tested on Python 3.12.3. Current Python versions write the last groups of IPv4-mapped addresses in dotted notation in IPv6Address.exploded, which broke the split into groups. This also crashes on main for e.g. ::ffff:0:0/96, and my patch added the same crash for /128s.

The groups now come from the address's integer value in both functions, with tests for /104 and /128. On the latest main, the suite, black and mypy pass on 3.11–3.14. The approval predates this commit, so please take another look.