Fix: Proper IFS restoration in all files (HIGH priority)

HIGH PRIORITY FIXES:
- lib/attack-patterns.sh:668 - Save/restore IFS around echo
- lib/php-analyzer.sh:511 - Save/restore IFS around sort operation
- modules/security/live-attack-monitor-v2.sh:1629 - Save/restore IFS properly

Issue: Modifying IFS without restoring it to previous value causes
word splitting issues in subsequent commands. Using 'unset IFS' is
less reliable than saving and restoring the original value.

Pattern applied:
  old_IFS=$IFS
  IFS='value'
  ...operation...
  IFS=$old_IFS

RESULTS:
- 3 HIGH IFS issues fixed
- Command execution now reliable after IFS modifications

lib/php-analyzer.sh

@@ -508,8 +508,10 @@ analyze_domain_traffic_advanced() {
     done
 
     # Sort values
-    IFS=$'\n' rpm_sorted=($(sort -n <<<"${rpm_values[*]}"))
-    unset IFS
+    local old_IFS="$IFS"
+    IFS=$'\n'
+    rpm_sorted=($(sort -n <<<"${rpm_values[*]}"))
+    IFS="$old_IFS"
 
     local peak_rpm=${rpm_sorted[-1]:-0}