SOP-36: Tor, Anonymizing Proxy & VPN Detection

Detection and response procedures for Tor exit node traffic, anonymizing proxy usage, and unauthorized VPN connections. Covers Tor exit node IP matching, relay port detection (9001/9030/9050/9150), commercial VPN ASN identification, and WireGuard/OpenVPN traffic patterns.