v0.2.0: offline JSON export, filter_functions fixes

Offline export

misp-ghidra no longer requires a reachable MISP instance. Analysis can now run on an isolated or air-gapped machine and produce a standard MISP event as a local JSON file, to be imported into MISP later from wherever that is possible.

• Headless: --offline exports to a JSON file instead of sending to the MISP API, and --out-dir selects the destination directory (defaults to the working directory). The file is written as misp_event_<event-uuid>.json using event.to_json(), so it is an ordinary MISP event document with no conversion step on import.
• GUI: the script now asks where the run should go — "Export to MISP Server" or "Export locally to JSON file (Offline)" — and then prompts for an output directory.
• Automatic fallback: if the MISP configuration cannot be loaded or the server cannot be reached, the run degrades to offline mode and still produces the JSON file. Previously a missing config.toml or an unreachable server ended the run and the analysis was lost.

Offline mode carries the full object model, not a reduced one: function objects, object references and call-tree relations are all built locally. Two operations still need a live server and report that clearly instead of failing — searching functions in MISP, and adding call-tree relations to an already existing event.

Fixed

Two bugs in filter_functions (mispghidra/PyMISPGhidraScripts.py), both reported and fixed by @elhoim.

• Function filtering aborted on the first thunk (#4). name was read by the thunk and import log lines before name = func.getName() bound it. The first thunk encountered — typically the first PLT entry of an ELF — raised NameError, which IOHandler.handle_exception_message re-raised as ValueError, ending the whole run instead of skipping one function. On later iterations the filter log showed the previous function's name. Affects any caller passing ignored_functions, including the shipped GUI-MISP-fetch-comments-for-all-functions.py.
• --min-blocks had no effect (#3). The basic-block size check logged Ignored small func but did not continue, so funcs.append(func) ran anyway and every function below the threshold was still exported. Runs using --min-blocks N with N > 0 produced events containing exactly the small functions the operator asked to exclude. The default of 0 was never affected.

Changed

• misp-objects is now a git submodule. Clone with --recurse-submodules, or run git submodule update --init in an existing checkout.
• The ghidra-function object definition was reworked and ghidra-program-metadata trimmed.

Full changelog: v0.1.0...v0.2.0