Minor changes on top of small_optimizations PR

[jeFF0Falltrades]

Summary

Follow-up changes on top of #44:

• config_normalization: Strip underscores from alias keys at map-build time so aliases like mutex_string actually resolve to Mutex. Restore unconditional underscore-stripping on the returned key to
  preserve the prior behavior for unrecognized keys.
• rat_config_parser._attempt_decryption: Replace the unreachable conditional trailing return with an unconditional raise to make the "decrypt-or-raise" invariant explicit.
• config_decryptor_aes_with_iv: Restore the -> list[bytes] and -> dict[str, str] return type hints that were dropped during reformatting, and document why key_size/block_size/algo are
  extracted once and shared across all metadata candidates.
• config_decryptor_aes_with_iv.decrypt_encrypted_strings: Fix a regression introduced in Small optimizations #44 where the new successfully_decrypted_count == 0 guard caused template/builder samples (e.g. unconfigured
  AsyncRAT builds whose config values are all placeholders like %Anti%) to fall through to the plaintext decryptor and lose the reported salt. Now tracks attempted decryptions separately and only raises when at least one decryption was attempted and all attempts failed.

[gemini-code-assist]

Code Review

This pull request refactors the decryption attempt logic to raise an exception directly if all decryptors fail, updates configuration key normalization to strip underscores during both map construction and lookup, and includes minor formatting and documentation improvements. The review feedback suggests further enhancing the normalization process by making it case-insensitive to ensure more robust key mapping.