add Windows Event Log message strings support

[joachimmetz]

• use winevt-rc.db to read and format Windows Event Log message strings at the formatting phase

[joachimmetz]

Preparations:

• Step 1: https://codereview.appspot.com/193700043/
• Step 2: https://codereview.appspot.com/204950043/

Add formatter mediator:

• Step 3: https://codereview.appspot.com/203920043/

Add initial winevt-rc support:

• Step 4: https://codereview.appspot.com/200460043/

After care:

• set data location to a sane default
• add support to pre format message string in PEP 3101 format
• add documentation on how to build and use winevt_rc.db (pending review and release)
• Add means to set the preferred LCID
  • https://codereview.appspot.com/215550043/
• Add more formatter tests
  • https://codereview.appspot.com/204410043/
  • https://codereview.appspot.com/213650043/
  • https://codereview.appspot.com/213680043
  • https://codereview.appspot.com/221880043/
  • https://codereview.appspot.com/228160043/

Future enhancements are now tracked in: #163

[joachimmetz]

Issue with the formatting of some messages due to spurious '{':

Fix "More than one value found in database." issue:

Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/plaso/formatters/winevtx.py", line 59, in GetMessages
    event_values[u'message_string'] = message_string.format(*strings)
KeyError: u'Reason'

SELECT * FROM event_log_providers WHERE log_source == 'Microsoft-Windows-Eventlog';
154|Microsoft-Windows-Eventlog|System|{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}
378|Microsoft-Windows-Eventlog|Security|{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}

So the reason for the duplicate is the log_type. Created: libyal/winevt-kb#7 to track adding support.

[joachimmetz]

Pending fixes/changes: http://codereview.appspot.com/216000043

[joachimmetz]

Documentation pending review and release. Moved improvement to a separate issues. Hence closing this issue.