Support for Office MRU (most recently used) entries

[puffyCid]

This PR adds support for parsing Windows Office and Office365 MRU entries.
These entries contain recently opened Office documents as well as the time the document was last opened.
Sample query below:

osquery> select * from office_most_recently_used;
+-------------+---------+--------------------------------------------+------------------+-----------------------------------------------+
| application | version | path                                       | last_opened_time | sid                                           |
+-------------+---------+--------------------------------------------+------------------+-----------------------------------------------+
| Access      | 16.0    | C:\Users\bob\Documents\Database1.accdb     | 1593373538       | S-1-5-21-1079689790-2336414676-942872339-1001 |
| Excel       | 16.0    | C:\Users\bob\Desktop\Sensitive_Info.xlsx   | 1593379329       | S-1-5-21-1079689790-2336414676-942872339-1001 |
| Excel       | 16.0    | C:\Users\bob\Desktop\Book1.xlsm            | 1593372755       | S-1-5-21-1079689790-2336414676-942872339-1001 |
| OneNote     | 16.0    | C:\Users\bob\Desktop\notes                 | 1593373799       | S-1-5-21-1079689790-2336414676-942872339-1001 |
| Publisher   | 16.0    | C:\Users\bob\Desktop\Publication1.pub      | 1593373586       | S-1-5-21-1079689790-2336414676-942872339-1001 |
| Word        | 16.0    | C:\Users\bob\Desktop\TotallyNotAPhish.docx | 1593372691       | S-1-5-21-1079689790-2336414676-942872339-1001 |
| Word        | 16.0    | C:\Users\bob\Desktop\Invoice.docx          | 1593372650       | S-1-5-21-1079689790-2336414676-942872339-1001 |
| Word        | 16.0    | C:\Users\bob\Desktop\Doc1.docx             | 1593368137       | S-1-5-21-1079689790-2336414676-942872339-1001 |
| Word        | 16.0    | C:\Users\bob\Desktop\testing.docx          | 1593366081       | S-1-5-21-1079689790-2336414676-942872339-1001 |
+-------------+---------+--------------------------------------------+------------------+-----------------------------------------------+

Let me know if there are any issues that need to be fixed

[theopolis]

I think in this case we can call this office_mru since the mru abbreviation is common enough. What do you think? Do people usually refer to this data as "MRU"?

[theopolis]

Hey @puffyCid, I made some changes, do you mind checking if the table still works? I do not have office installed and my Windows VM is a little flaky.

[puffyCid]

thanks @theopolis for the changes. i pulled the changes, re-compiled osquery, and the table still works.
Thanks!