fix(security): normalize indicators before private IP filtering

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>

security/security-threat-intelligence-analyst.md

@@ -493,16 +493,16 @@ class IOCEnrichmentPipeline:
         results = []
 
         for raw in raw_indicators:
-            ioc_type = self.classifier.classify(raw)
+            value = raw.strip()
+            ioc_type = self.classifier.classify(value)
             if ioc_type is None:
                 continue  # Skip unrecognized indicators
 
             # Skip private IPs
             if ioc_type in (IOCType.IPV4, IOCType.IPV6):
-                if self.classifier.is_private_ip(raw):
+                if self.classifier.is_private_ip(value):
                     continue
 
-            value = raw.strip()
             if ioc_type != IOCType.URL:
                 value = value.lower()