Add isMalicious expansion and hover module

[hexablob]

Closes #797

Description

Adds misp_modules/modules/expansion/ismalicious.py, an expansion + hover module that calls GET https://api.ismalicious.com/check with X-API-KEY.

Input types: ip-src, ip-dst, hostname, domain, url, domain|ip

Config: api_key (required), api_url (optional, default https://api.ismalicious.com)

Output: a text attribute summarizing malicious, risk score, categories, and source count. Hover and expansion share the same handler.

No extra Python dependencies (requests is already used by other expansion modules). Expansion modules in this directory are auto-discovered.

Docs: https://ismalicious.com/integrations/misp

[hexablob]

Ready for review. Expansion + hover module, auto-discovered under misp_modules/modules/expansion/. Uses requests only. Config: api_key (required), api_url (optional).