Defer MITRE data loading in tag validators to first use

[Copilot]

ATTACKTagValidator and D3FENDTagValidator eagerly load MITRE data in __init__(), triggering network requests during plugin discovery — before set_url() can redirect to a local source. This causes timeouts in offline environments when using sigma-cli with --url.

Changes

• sigma/validators/core/tags.py: Replace eager data loading in __init__() with lazy initialization via a None sentinel. Data is now fetched on first validate_tag() call through a _load_allowed_tags() method.

# Before: loads data at instantiation
class ATTACKTagValidator(SigmaTagValidator):
    def __init__(self) -> None:
        self.allowed_tags = {tactic.lower() for tactic in mitre_attack.mitre_attack_tactics.values()} ...

# After: defers loading to first validation call
class ATTACKTagValidator(SigmaTagValidator):
    def __init__(self) -> None:
        self.allowed_tags: set[str] | None = None

    def validate_tag(self, tag: SigmaRuleTag) -> list[SigmaValidationIssue]:
        if self.allowed_tags is None:
            self.allowed_tags = self._load_allowed_tags()
        ...

The sigma.data modules themselves already use lazy loading via __getattr__ — the problem was solely in the consumer side.