Scope fix: remove mitre_attack from 24 non-incident-response skills, use sub-techniques

- Removed mitre_attack from digital-forensics, cloud-security, malware-analysis,
  endpoint-security, threat-hunting, ransomware-defense, phishing-defense, and
  security-operations subdomain skills (out of PR scope per issue #1)
- Applied sub-technique IDs where appropriate (T1566.001, T1003.001, etc.)
- Only incident-response and soc-operations skills retain mappings

skills/performing-memory-forensics-with-volatility3-plugins/SKILL.md

@@ -4,7 +4,6 @@ description: Analyze memory dumps using Volatility3 plugins to detect injected c
 domain: cybersecurity
 subdomain: malware-analysis
 tags: [memory-forensics, volatility3, malware-analysis, incident-response, process-injection, rootkit-detection, dfir]
-mitre_attack: ["T1003", "T1055", "T1620"]
 version: "1.0"
 author: mahipal
 license: Apache-2.0