Add Lunar Domain Exposure API as an optional enrichment source

[rangeva]

It may be useful to add Lunar’s Domain Exposure API as an optional enrichment source for compromised domains.

The API returns domain-level exposure data related to infostealer logs and data breaches, including exposure counts, recent activity, malware families, affected services, and infected device metadata.

The API is free to use and does not require an API token.

Example:
https://api.lunarcyber.com/domain-exposure?domain=stryker.com

[soccerlover29]

I've opened a draft PR for this: #2034

The Lunar API is free and needs no API key. A couple of things worth knowing for anyone implementing this:

1. The API always returns HTTP 200. The real response shape is {status, requestUuid, domain, periodFrom, periodTo, report} where status is one of REPORT_READY, GENERATING_REPORT, NOT_AUTHORIZED, or INVALID_DOMAIN, and all exposure data lives under report.summary (total_events, infostealer_events, data_breach_events, ...) and report.malware_family_breakdown.

2. I tested the module in PR feat: add LunarCryber module #2030 against live API responses and it produces no events for real domains, because it parses top-level fields (exposure_count, malware_families) that the API never returns.

The draft PR above includes unit tests for all four API statuses plus live-verified output, and preserves the full report as RAW_RIR_DATA alongside a MALICIOUS_INTERNET_NAME summary.