Revisit approach to hash tagging analysis

[joachimmetz]

Plaso's approach is event-centric. This means that when looking at events for hash tagging analysis there is a lot of duplication since many events can originate from the same data stream, from which a hash is calculated.

Revisit approach to hash tagging analysis to make this more efficient. Consider:

• store labels on a per-object basis (event, event data, event data stream)
• have different types of analysis plugins (event, event data, event data stream)
• remove the need for the threaded approach use multi processing approach - hash_tagging: Undefined behavior within Python threading can cause incomplete processing #4050

Related issues:

• Hash tagging analysis report too large #1048
• Performance: export after nsrlsvr analysis very slow #1047
• change analysis process to directly read from storage file #3439
• change hash analysis modules to analyze event data streams instead of events #3438
• nsrlsvr analysis plugin reaches worker memory limit #3286