[analyser] timesketch full rewrite / revamp

[cvandeplas]

Completely re-assess the timesketch analyser as with the change of model to time-based events it becomes redundant. Summarized: ideally there should not be a timesketch analyser: the jsonl output of the parsers should be compatible. So contain the mandatory fields, and use timestamp in microseconds.

Also the message field, which is a human readable summary, should be implemented in the parser.

In the meantime the timesketch analyser is declared broken and disabled (changed file extension to .broken

[ddurvaux]

Partially rebuild using the new architecture in hackthon25 branch

[ddurvaux]

New version of the analyser finished

• took input from all the parsers that returns timestamp
• put as message all the elements returned by the parsers as a JSON object
• put as as timestamp_desc the name of the parser.

[cvandeplas]

re-implemented it natively as discussed in the original message