feat(threatmatch): migrate connector to manager-supported mode (#6868)

[jabesq]

Proposed changes

• Normalize config files for manager-supported migration: fix the misspelled THREATMATCH_THREAT_ACTOR_AS_INSTRUSION_SET env var to THREATMATCH_THREAT_ACTOR_AS_INTRUSION_SET in docker-compose.yml, and add the connectors-sdk dependency in src/requirements.txt.
• Add field descriptions to all Pydantic settings (OpenCTI, connector, and ThreatMatch sections) and tighten types: log_level is now a Literal, and import_from_date becomes optional with a field_validator defaulting to a 30-day relative window on first run.
• Modernize datetime handling in config.py by switching to explicit datetime/timedelta/timezone imports.
• Set manager_supported: true in the connector manifest.
• Generate the connector config schema (__metadata__/connector_config_schema.json) and documentation (__metadata__/CONNECTOR_CONFIG_DOC.md) for manager-supported mode.

Related issues

• Closes feat(ThreatMatch): migrate connector to the catalog #6868

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

This connector was already partly modernized; this stack enhances the Pydantic settings (field descriptions, stricter types) and generates the config schema/doc required for manager-supported mode.

[github-actions]

🔴 Connector Linter errors detected

• VC302: Author is defined but never referenced on STIX entities (external-import/threatmatch:1)
• VC402: Dockerfile uses entrypoint.sh at line 15 (external-import/threatmatch/Dockerfile:15)

[Copilot]

Pull request overview

This PR migrates the ThreatMatch external-import connector toward manager-supported mode by tightening and documenting its Pydantic settings, normalizing configuration inputs, and adding the generated schema/docs needed for catalog/manager usage.

Changes:

• Updated config.py settings models with field descriptions, stricter types (e.g., Literal for log level), and a first-run defaulting strategy for import_from_date.
• Fixed a misspelled ThreatMatch env var in docker-compose.yml and marked the connector as manager_supported: true.
• Added generated manager configuration artifacts (connector_config_schema.json, CONNECTOR_CONFIG_DOC.md) and introduced a connectors-sdk dependency in requirements.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
external-import/threatmatch/src/threatmatch/config.py	Modernizes datetime handling and enhances/validates settings models for manager-supported configuration.
external-import/threatmatch/src/requirements.txt	Adds an additional dependency intended for manager-supported migration.
external-import/threatmatch/docker-compose.yml	Corrects the ThreatMatch env var spelling for intrusion-set mapping.
external-import/threatmatch/metadata/connector_manifest.json	Flags the connector as manager-supported.
external-import/threatmatch/metadata/connector_config_schema.json	Adds generated JSON schema for manager configuration.
external-import/threatmatch/metadata/CONNECTOR_CONFIG_DOC.md	Adds generated documentation for all configuration keys.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #6996       +/-   ##
===========================================
+ Coverage   35.64%   74.03%   +38.39%     
===========================================
  Files        2048        8     -2040     
  Lines      125310      651   -124659     
===========================================
- Hits        44672      482    -44190     
+ Misses      80638      169    -80469     

Files with missing lines	Coverage Δ
external-import/threatmatch/src/main.py	72.22% <100.00%> (ø)
...ernal-import/threatmatch/src/threatmatch/config.py	100.00% <100.00%> (+6.66%)	⬆️

... and 2038 files with indirect coverage changes

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.