MemPE v0.1.5

This release gets more out of a single snapshot.

PEs stored inside other images are written out as their own files now. Packers and
protectors often carry a second payload in a resource directory, and until now
those bytes ended up inside the dumped host with nothing saying they were there.
Every candidate has to parse as a real disk-layout PE before it is written, and
the extension follows the subsystem, so a native subsystem image becomes .sys.
Across fourteen unrelated processes the only files carved were genuine embedded
images.

The output reports how much of an image was written after it loaded, counted
through the working set. On an ordinary program that is a couple of percent. On a
packed one it was a third or more. The count has to be taken before mempe makes
its own snapshot, because the clone marks private pages as shared and they do not
revert, so a repeat dump of the same process says the figure is not measurable
instead of printing zero.

Images the loader does not list are named from their backing file and reported. An
export name RVA of zero is no longer read as a string. It resolved to the DOS
signature, so an image with a stripped export name was written out as MZ.exe and
every export it held was attributed to a module that does not exist.

Rebuilt files carry more of what was in memory. The debug directory is kept rather
than discarded and its file offsets are repointed at the new layout, so pdb paths
and build GUIDs survive. Sections that were executable in memory get their code
flag back, since marking the real code section as data is a common way to keep
analysis tools on the stub. A relocation directory has to walk as real relocation
blocks before it survives, and ASLR is cleared on images with no usable
relocations. Section names made of spaces or raw bytes are replaced, TLS callbacks
are counted, and the entry point is shown with the section holding it.

A process that refuses memory access now says so, and suggests an elevated
terminal, instead of blaming the module snapshot. A single bad import descriptor
no longer discards the descriptors that parsed before it.

The PID and process name workflows work the same as before. The release build
passed all 40 tests.