Graceful degradation for MITRE data loaders on network failure

[Copilot]

On offline systems, sigma pysigma update-cache --url mitre_attack:"./enterprise-attack.json" fails with urllib.error.URLError because the sigma-cli iterates all datasets and mitre_d3fend (without a URL override) still attempts to download from the default URL.

PR #465 deferred MITRE loading in tag validators, but the data loaders themselves still raise on any network failure, even when no custom URL was explicitly configured.

Changes

• sigma/data/mitre_attack.py and sigma/data/mitre_d3fend.py: When loading from the default URL fails, return empty data with a warnings.warn() instead of raising RuntimeError. Custom URL failures still raise — the user explicitly configured a source and should know it's broken.
• Added _empty_data() helpers returning the expected dict structure with empty collections.
• 4 new tests covering both the graceful degradation path and the custom-URL-still-raises path for each module.

# Custom URL (explicit user config) — still raises on failure
mitre_attack.set_url("/bad/path.json")
mitre_attack.mitre_attack_tactics  # RuntimeError

# Default URL (no set_url called) — warns and returns empty
# Previously: RuntimeError / URLError
mitre_attack.mitre_attack_tactics  # {} + UserWarning