Allow 'observables' in attributes

[query-jeremy]

Background

While discussing #960 today, it was raised that altering the type of attributes from string_t or int_t to more specific types like user_agent_t is a breaking change.

We could wait until the 2.x line to introduce this, or we could break with semver and accept a breaking change in 1.x. But neither of these are desirable.

Proposal

An alternative solution is to add the observable property to attributes. Currently, only types and objects support the observable property.

This could be defined in any event, object, or dictionary.

Example:

{
  "attributes": {
    "user_agent": {
      "observable": 19,
      ...
    },
    ...
}

Upside

• As this is an additive change, it is non-breaking and does not require a major semver bump. Consumers and producers that don't support it will continue to operate as before.
• This provides a (slightly) more flexible way to define observables.

Downside

• This would need to be implemented in the OCSF server.
• It (slightly) increases effort involved in troubleshooting observables.
• All validators will need to be updated.
• Platform implementations of observables may need to be updated.