feat: Allow using contentctl to send data trough EP with hec (ADDON-82127)

[mgazda-splunk]

This adds support for optionally specifying HEC servers being different than Splunk servers.

So instead:
contentctl -> HEC Splunk -> Search Splunk -> result

Will be:
contentctl -> HEC server (EP with SPL2 pipeline) -> EP sends data to Splunk with S2S/HEC -> Search Splunk -> result

[Copilot]

Pull Request Overview

This PR enables specifying separate HTTP Event Collector (HEC) endpoints distinct from Splunk server addresses, both in configuration and detection-testing workflows.

• Introduces hec_instance_address field in the Infrastructure model and propagates it through test-server parsing.
• Adds hec_server_overrides to allow semicolon-delimited HEC address overrides for test instances.
• Updates the hec_raw_replay logic to prefer hec_instance_address when constructing the target URL.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
contentctl/objects/config.py	Added hec_instance_address and hec_server_overrides, updated parsing logic to apply overrides.
contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py	Modified replay URL builder to use hec_instance_address when present.

Comments suppressed due to low confidence (3)

contentctl/objects/config.py:1267

• Consider using a List[str] type for hec_server_overrides instead of a semicolon-delimited string to leverage Pydantic’s native list parsing and provide clearer type safety.

 hec_server_overrides: Optional[str] = Field(

contentctl/objects/config.py:1296

• [nitpick] Rename split_hec_server_overrides to something like hec_override_list to better convey that it holds the parsed override addresses.

 split_hec_server_overrides = []

contentctl/objects/config.py:1299

• Filter out empty strings after splitting (e.g., hec_server_overrides.split(";") if s) to avoid indexing errors when trailing semicolons are present.

 split_hec_server_overrides = hec_server_overrides.split(";")

[Copilot]

[nitpick] Normalize hec_instance_address once (e.g., addr = hec_instance_address.strip().lower()) before the if/elif/else to avoid repeated calls and improve readability.

[Copilot]

[nitpick] Apply .strip().lower() to hec_instance_address in the else branch to ensure consistent normalization, e.g., f"https://{hec_instance_address.strip().lower()}".

Suggested change

	address_with_scheme=f"https://{hec_instance_address}"
	address_with_scheme=f"https://{hec_instance_address.strip().lower()}"