ETW Trim/Prune Utility

[planetchili]

ETW files are often prohibitively large. The sheer number of events means that verbose tracing can take 30 minutes+ per run. Solutions:

1. filter events to the same set of events that presentmon itself filters to when doing realtime tracing
2. Trim events by timestamp to a shorter region of interest, decreasing the verbose trace time proportionally

Challenges: Set of trace filters is tightly coupled to PresentData logic for starting an actual trace; this needs to be decoupled. There are events from providers outside the filter set that are received and processed, so these need be identified. When trimming, care must be taken to maintain the state context that tracking depends on (initial process / context state dumps, etc.)

Filtering works and results in a 97% reduction of file size. Currently, trimming works except for GPU work tracing. In order to identify the missing events, verbose processing is required, but currently verbose is acting non-deterministically, so that issue must be addressed first. #359