MISP: align Report created/published timestamps with event publication time

[Copilot]

MISP-ingested reports could show an OpenCTI "original creation date" earlier than the source report publication. This came from deriving report creation metadata from Event.date instead of the actual publication timestamp.

• Timestamp source correction (Report metadata)

  • Updated EventConverter.create_report() to prefer Event.publish_timestamp for Report.created and Report.published when available (> 0).
  • This aligns OpenCTI report creation metadata with MISP event publication time.

• Safe fallback behavior

  • When publish_timestamp is missing/zero, fallback remains Event.date.
  • Fallback now handles both naive and timezone-aware ISO dates without losing timezone semantics.

• Regression coverage

  • Added focused tests for:
    • publish-timestamp-first behavior
    • fallback-to-date behavior
    • preserving modified from Event.timestamp

if event.Event.publish_timestamp and int(event.Event.publish_timestamp) > 0:
    created_at = datetime.fromtimestamp(int(event.Event.publish_timestamp), tz=timezone.utc)
else:
    event_date = datetime.fromisoformat(event.Event.date)
    created_at = (
        event_date.astimezone(tz=timezone.utc)
        if event_date.tzinfo
        else event_date.replace(tzinfo=timezone.utc)
    )