Changes to Windows Firewall & non-default exceptions analyzer

[berggren]

Create an analyzer that tags event log entries indicating changes to Windows Firewall. Also, mark as suspicious those Windows Firewall exceptions in the registry that have non-standard properties (compare the build-in exceptions to those created manually).

[binglot]

High-light any NETSH PortProxy exceptions (fun fact, the registry key for PortProxy doesn't exist on a default Windows installation so even if an exception is deleted, the mere fact that it exists tells you that someone created a PortProxy rule in the past).