Created new window pipe for sliding window aggregations

[itsnotapt]

The concept of pipes doesn't work very well in context of streaming events. In order to allow pipes to function as expected in the streaming scenario, I've added a new "window" pipe that will buffer events into a sliding window, allowing all pipes to function as expected even when streaming.

A typical example of this feature would be the following:

    process where process_name in ("whoami.exe", "netstat.exe", "hostname.exe", "net.exe", "sc.exe", "systeminfo.exe")
    | window 5m
    | unique hostname, process_name
    | unique_count process_name
    | filter count >= 3

In this example, the query is effective in both streaming and one off batches.

[itsnotapt]

@rw-access I removed the tight coupling with host_key associated with pipes, as this seems very environment specific and breaks some common scenarios.
The functionality is still available with pipes anyway, e.g. unique hostname, process_name | count hostname.

I had to "reset" state after the pipe receives PIPE_EOF, otherwise the pipe will retain counts, unique sets, etc from the previous emitted window buffer.

I don't have your test data, so I wasn't able to do a full test. My biggest concern is cases where I missed an object that should be immutable e.g. 37ee552.

[itsnotapt]

Other things to consider, the analytic will technically hold onto the buffer longer than necessary, e.g. imagine we get a burst of events in a timespan, then no events. The buffer will retain this spike until another event in the future triggers the buffer cleanup.

I thought about adding a garbage cleanup routine, but I feel it's not a significant issue given it's unlikely to cause a relevant memory issue.

[itsnotapt]

@rw-access I've updated this code for EQL 0.7.0 and rolled back the host_key changes to make it easier for you to review.

I made a change to the head pipe for the test case of test_pipes_reset_state to work correctly. I couldn't see any code that suggested that head would exit early, so I believe the performance is unchanged.