Add tags for FIM directories and registries

[chemamartinez]

This PR adds a new attribute called tags for monitored directories and registries as follows:

<!-- Directories -->
<directories check_all="yes" whodata="yes" tags="whodata-folder, test_tag">/root/whodata-syscheck</directories>

<!-- Windows registry -->
<windows_registry tags="services-registry">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry>

These tags are separated by commas, and they are included in the alert fields:

Plain alert

** Alert 1534149464.85834: - ossec,syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,
2018 Aug 13 10:37:44 ubuntu18->syscheck
Rule: 550 (level 7) -> 'Integrity checksum changed.'
Integrity checksum changed for: '/root/whodata-syscheck/file'
Size changed from '0' to '5'
Old md5sum was: 'd41d8cd98f00b204e9800998ecf8427e'
New md5sum is : 'd8e8fca2dc0f896fd7cb4cb0031ba249'
Old sha1sum was: 'da39a3ee5e6b4b0d3255bfef95601890afd80709'
New sha1sum is : '4e1243bd22c66e76c2ba9eddc1f91394e57f9f83'
Old sha256sum was: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
New sha256sum is : 'f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2'
(Audit) User: 'root (0)'
(Audit) Login user: 'root (0)'
(Audit) Effective user: 'root (0)'
(Audit) Group: 'root (0)'
(Audit) Process id: '1881'
(Audit) Process name: '/bin/bash'

Attributes:
 - Size: 5
 - Permissions: 100644
 - Date: Mon Aug 13 10:37:43 2018
 - Inode: 1180095
 - User: root (0)
 - Group: root (0)
 - MD5: d8e8fca2dc0f896fd7cb4cb0031ba249
 - SHA1: 4e1243bd22c66e76c2ba9eddc1f91394e57f9f83
 - SHA256: f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2

Tags:
 - whodata-folder
 - test_tag

JSON alert

...
"syscheck": {
    "path": "/root/whodata-syscheck/file",
    "size_before": "0",
    "size_after": "5",
    "perm_after": "100644",
    "uid_after": "0",
    "gid_after": "0",
    "md5_before": "d41d8cd98f00b204e9800998ecf8427e",
    "md5_after": "d8e8fca2dc0f896fd7cb4cb0031ba249",
    "sha1_before": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
    "sha1_after": "4e1243bd22c66e76c2ba9eddc1f91394e57f9f83",
    "sha256_before": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "sha256_after": "f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2",
    "uname_after": "root",
    "gname_after": "root",
    "mtime_before": "2018-08-10T16:02:27",
    "mtime_after": "2018-08-13T10:37:43",
    "inode_after": 1180095,
    "tags": [
      "whodata-folder",
      "test_tag"
    ],
    "event": "modified",
    "audit": {
      "user": {
        "id": "0",
        "name": "root"
      },
      "group": {
        "id": "0",
        "name": "root"
      },
      "proccess": {
        "id": "1881",
        "name": "/bin/bash",
        "ppid": "1808"
      }
...

It is necessary to include the new attribute in the Syscheck reference before merging this PR.

[vikman90]

A file like this would break the tag chain: my file<!other tag,

[vikman90]

Change version to 3.6.0

[vikman90]

We should put the tags after the checksum.