Add parsed timestamps to alerts - #870

Summary

• Populate alert event times from timestamps already parsed by the corresponding Android and iOS modules.
• Use explicit timestamp precedence for records that contain multiple dates.
• Add regression assertions for multi-date alert handling.

Why

Some alerts omitted their event time even though the source module had already parsed a suitable timestamp. This kept otherwise timestamped detections out of the alert timeline.

For AppOps, an IOC match applies to the package name rather than to a particular permission entry. A package can have multiple last-access and last-rejection timestamps across its operations and UID states, so the alert uses the latest of those timestamps. This places the package-level alert at its most recent known AppOps activity without depending on permission iteration order. It does not represent the package installation time, compromise time, or IOC detection time.