Expand SID with actual user name and domain

[cosmo0920]

This is needed to compete for the competitor of elastic beats.
ref: https://www.elastic.co/guide/en/beats/filebeat/current/processor-translate-sid.html

[cosmo0920]

In addition, we already implemented this feature on Fluent Bit. I ported and modified for winevt_c adoptions.

[cosmo0920]

AppVeyor failures on Ruby 2.6 and 2.7 is reported here: appveyor/ci#3928

[cosmo0920]

With applying this patch, the example xml false case could retrieve SID translated User record:

---

{:eventlog=>{"ProviderName"=>"IPF", "ProviderGuid"=>"{D3CB85D1-D61C-4BCF-9674-7910EE54D6AF}", "Qualifiers"=>"", "EventID"=>17, "Version"=>0, "Level"=>2, "Task"=>0, "Opcode"=>0, "Keywords"=>"0x8000000000000000", "TimeCreated"=>"2024/07/30 02:56:21.199507400", "EventRecordID"=>"65489", "ProcessID"=>7688, "ThreadID"=>39268, "Channel"=>"Application", "Computer"=>"hiroshi-14-eu", "UserID"=>"S-1-5-19", "User"=>"NT AUTHORITY\\LOCAL SERVICE"}, :data=>"ESIF(1.0.11406.42226) TYPE: ERROR MODULE: IPF TIME 1670614500 ms\n\n[<IPFSRV>AuthMgr_EsifPrimitive@ipfsrv_authmgr.c#1631]<1670614500 ms>: \nUnauthorized EsifPrimitive: GET_SUPPORTED_POLICIES (92)"}

"UserID"=>"S-1-5-19", "User"=>"NT AUTHORITY\LOCAL SERVICE"

[daipom]

LGTM.
Thanks for this enhancement!

[cosmo0920]

@ashie @kenhys Is there anything else we have to address in this PR?

[ashie]

LGTM

There is nothing else to be concerned at this time.
If we have any other concerns later, we'll address them in other PR.

Thanks for your effort!

[ashie]

@cosmo0920
I'm considering to release it as 0.11.0.
Are you O.K.?

[cosmo0920]

Yes, go ahead.
BTW, we added the new options was assumed to be released as v0.10.3.
So, could you modify the versions for Yard doc?
Otherwise, it’s fine on our side.