Add a table for the unified log on darwin

[GarretReece]

This code implements a virtual table for darwin that uses the OSLog framework to read and return entries from the unified system log. Prior versions of macOS did not have an api to access this data, necessitating an extension that invoked the log utility. macOS 10.15 makes this no longer necessary.

At the moment I've tested these changes only on a 10.15 vm. I'd be grateful to the community for feedback regarding building on earlier versions of macOS.

Closes #5760

[directionless]

I love seeing this! Some questions/nits

[directionless]

I'm having trouble finding docs on the object in question, but man logs also describes eventType, messageType, processImagePath, and senderImagePath. Do you think we care about any of those?

[GarretReece]

the best place to find docs would probably be the entry for OSLogEntryLog. processImagePath and senderImagePath aren't exposed in this API. eventType might be something we can extract, I'll take a look, though I don't think so. messageType is the severity of the message when the event type is a log or trace event--I'm not sure it's exposed in this api either. I'll dig in.

[uptycs-rmack]

Something like this might work:

const char* aulLevelNames[] = {
[OSLogEntryLogLevelUndefined] = "undefined",
[OSLogEntryLogLevelDebug] = "debug",
[OSLogEntryLogLevelInfo] = "info",
[OSLogEntryLogLevelNotice] = "default",
[OSLogEntryLogLevelError] = "error",
[OSLogEntryLogLevelFault] = "fault",
};

  if ([entry isKindOfClass:[OSLogEntryLog class]]) { 
    r["type"] = aulLevelNames[[(OSLogEntryLog*)entry level]];
  } else if ([entry isKindOfClass:[OSLogEntryActivity class]]) {
     r["type"] = "activity";
  } 

[theopolis]

I think this is slightly dangerous. If the set of logtypes change then this could fault. However, that seems unlikely. Can you use a C++ container to get this same effect, then you will except vs. fault.

[mike-myers-tob]

I did some ad-hoc testing on macOS 11.2 and it works there also (previously was tested only on 10.15).

If anyone would like to help with this PR, I see a few things to finish:

1. Querying the table without any reasonable constraints resulted in a segfault, so I think we'll have to determine the root cause of that and whether it can be prevented
2. Add some unit tests
3. Add a section to the wiki page about syslog consumption on macOS with osquery which is currently about ASL

[mike-myers-tob]

Much thanks to @GarretReece and @puffyCid on this, we can close this PR in favor of finishing the work in #7259