Add prefix matching support to Wazuh 5 KVDBs similar to Wazuh 4 match_address_key CDB lookups

Wazuh version	Component	Install type	Install method	Platform
5.0.0 beta 5	normalization engine	Manager	n/a	n/a

Under Wazuh 4, CDB lists support the "address_match_key" lookup type in which CDB keys can include IPv4 prefixes like "132.165." or "172.16.22." or "10.", and full event IP addresses looked up against such a list in this way would match if they started with any of the prefixes in the list. It is a helpful way to do subnet comparison at least at the simple even-byte-boundary level. I think this is a popular use case for Wazuh 4 CDBs.

Though in general an amazing upgrade from legacy CDBs, the new Wazuh KVDBs as yet support only exact-match lookups. Please explore how the original IP-prefix lookup use case could be supported with KVDBs.

Of course the ideal would be to support real CIDR-subnet-formatted KVDB entries, however given that KVDBs are stored as RockDB databases which do not inherently support CIDR awareness, I'm not going to ask for that.

From my reading, it does sounds like RockDB could reasonably support the Wazuh KVDB facility making longest-prefix-match lookups against KVDBs. In fact, if done right, this could cover an even broader use case than Wazuh 4 CDB IPv4 prefix matches, and encompass any KVDB key being optionally treated as a string prefix to compare to the beginning of field values that are being analyzed. That would open up all sorts of fascinating possibilities.

Anyway, thanks again for your consideration of this request, Kevin Branch Blue Wolf Ninja