Add Support for Logging to JSON (beta feature)

[pmarkowsky]

This PR adds support for logging our protobuf output as JSON to a file. This writes events out one JSON dict per line. e.g.

{"execution":{"instigator":{"id":{"pid":96709,"pidversion":635028},"parent_id":{"pid":1,"pidversion":1},"effective_user":{"uid":0,"name":"root"},"effective_group":{"gid":0,"name":"wheel"},"real_user":{"uid":0,"name":"root"},"real_group":{"gid":0,"name":"wheel"},"executable":{"path":"/sbin/launchd","truncated":false},"original_parent_pid":1,"group_id":1,"session_id":1},"target":{"id":{"pid":96709,"pidversion":635029},"parent_id":{"pid":1,"pidversion":1},"responsible_id":{"pid":96709,"pidversion":635029},"effective_user":{"uid":0,"name":"root"},"effective_group":{"gid":0,"name":"wheel"},"real_user":{"uid":0,"name":"root"},"real_group":{"gid":0,"name":"wheel"},"code_signature":{"cdhash":"BIxT/53jIXsWRl5Ry+rgpxhSsuQ=","signing_id":"com.apple.xpc.proxy"},"executable":{"stat":{"user":{"uid":0,"name":"root"},"group":{"gid":0,"name":"wheel"},"dev":16777220,"mode":33261,"nlink":1,"ino":"1152921500312442523","rdev":0,"access_time":"2023-04-06T12:26:56Z","modification_time":"2023-04-06T12:26:56Z","change_time":"2023-04-06T12:26:56Z","birth_time":"2023-04-06T12:26:56Z","size":"229408","blocks":"96","blksize":4096,"flags":524320,"gen":0},"hash":{"type":"HASH_ALGO_SHA256","hash":"87123356520a2da34f61d999e21e86083691d3d67e4ac7a447a6dde969d38530"},"path":"/usr/libexec/xpcproxy","truncated":false},"original_parent_pid":1,"group_id":1,"session_id":1,"is_platform_binary":true,"is_es_client":false,"cs_flags":570509825,"start_time":"2023-06-22T18:04:00.898499Z"},"working_directory":{"stat":{"user":{"uid":0,"name":"root"},"group":{"gid":0,"name":"wheel"},"dev":16777220,"mode":16877,"nlink":20,"ino":"2","rdev":0,"access_time":"2023-04-06T12:26:56Z","modification_time":"2023-04-06T12:26:56Z","change_time":"2023-04-06T12:26:56Z","birth_time":"2023-04-06T12:26:56Z","size":"640","blocks":"0","blksize":4096,"flags":1048576,"gen":0},"path":"/","truncated":false},"args":["eHBjcHJveHk=","Y29tLmdvb2dsZS5paGVsbS5Mb2dEdW1wZXIucHJlc2VuY2U="],"envs":["WFBDX0ZMQUdTPTB4MA=="],"fds":[{"fd":0,"fd_type":"FD_TYPE_VNODE"},{"fd":1,"fd_type":"FD_TYPE_VNODE"},{"fd":2,"fd_type":"FD_TYPE_VNODE"}],"certificate_info":{"hash":{"type":"HASH_ALGO_SHA256","hash":"d84db96af8c2e60ac4c851a21ec460f6f84e0235beb17d24a78712b9b021ed57"},"common_name":"Software Signing"},"fd_list_truncated":false,"decision":"DECISION_ALLOW","reason":"REASON_BINARY","mode":"MODE_UNKNOWN","explain":"critical system binary"},"event_time":"2023-06-22T18:04:00.899417997Z","processed_time":"2023-06-22T18:04:00.970971Z"}

Config-Overrides file to Test With

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>    
    <key>EventLogPath</key>
    <string>/var/db/santa/santa.json</string>
    <key>EventLogType</key>
    <string>json</string>
  </dict>
</plist>