Add `AMSI` telemetry support via a new `AmsiScanBuffer` event type

[rabbitstack]

Motivation

Extend Fibratus's detection capabilities by obtaining AMSI (Antimalware Scan Interface) telemetry, which captures buffers submitted for scanning by AMSI-aware hosts (most notably PowerShell) before they're executed.

Expectation

Fibratus gains a new AmsiScanBuffer event type, sourced from the Microsoft-Antimalware-Scan-Interface ETW provider, that can be used to detect PowerShell cmdlet execution and any other activity surfaced through AMSI scanning (e.g. obfuscated/deobfuscated script content, dynamic code execution via Invoke-Expression, in-memory .NET assembly loading).

Proposal

• Enable/attach to the Microsoft-Antimalware-Scan-Interface ETW provider and handle its AmsiScanBuffer event
• Parse the event's binary payload via the ParamDecoder, consistent with how other ETW events are decoded in Fibratus
• Reference schema: see the Microsoft-Antimalware-Scan-Interface manifest (nasbench/EVTX-ETW-Resources) for the field layout of AmsiScanBuffer event

Additional context

The scanned buffer/content itself is the highest-value field for detection (e.g. matching known malicious PowerShell patterns), so decoding it correctly, including any length/session/correlation fields tying scans to a process, should be a priority