Allow file access logging from binaries in the default mute set

[mlw]

Currently, the File Access Authorization feature does not operate on access attempts from binaries within the default mute set. This is largely due to two issues:

1. The basic mechanism used by Santa to auto-respond to messages about to miss a response deadline is not flexible enough to handle AUTH events with very low timeouts.
   • One option would be to maintain an ordered map with the key being the deadline and some polling method that ensures messages about to reach their deadline are responded to.
2. Minor: The message processing of AUTH events in the File Access Authorizer ES client should be done inline with the message callback (i.e. in the es_handler_block_t block given to es_new_client)
   • As of now, it doesn't appear that message processing requires any operations that would block in external processes. We could take advantage of the handler block running on a much higher priority queue to achieve more throughput, and only go async when logging.

[pmarkowsky]

@mlw is this going to become a bigger issue in the future if the default timeout is dropped?

[mlw]

We likely wouldn't want to enable events from binaries in the default mute set without first reworking how we handle processing auth events and automatic fallback responses.