Content changer improvements and Stale Reference Updates

[pyth0n1c]

This is a significant PR with a group of updates that seeks to improve content_ctl performance and update the references linked in our detections, stories, playbooks, etc.

Updates to content_changer
When speaking with some customers, they indicated that they are largely following the structure of our YMLs. However, there are a number of fields that we use (for construction of things like analytic stories, attack mapping frameworks, etc) that are not included in their detections. content_changer now enumerates all the available transforms (and will auto-update if we add additional transforms) when passing --help at the command line. An "all" function has also been added which will apply all the transforms and add default values if they are missing. This allows a detection which is missing a number of fields to be updated so that it can process successfully.

Speedup for content_ctl validate and generate CveEnrichment and AttackEnrichment
content_ctl validate and generate functions perform a large number of REST API calls when processing our content. However, the endpoints these reach out to can be slow and a single run of content_ctl may take 5 minutes (or longer if the endpoints are particularly slow). There are two optimizations in place here:

• Calls to CVE Enrichment are always cached in memory but are not written to disk for persistence. This means that subsequent calls on the same CVE return instantly, saving time.
  TEST COMMAND (no change from current command line):
  python contentctl.py --path . validate --product ESCU

• The command line argument --cached_and_offline will force attack_enrichment to use the cached mitre_enrichment located at lookups/mitre_enrichment.csv. It will also Cache calls to CveEnrichment to disk at lookups/CVE_CACHE.db. Using this option means that after the first run of the tool, subsequent calls return in less than 10 seconds, speeding up development and troubleshooting significantly.
  TEST COMMAND (try running twice to observe the difference):
  python contentctl.py --path . --cached_and_offline validate --product ESCU
  python contentctl.py --path . --cached_and_offline validate --product ESCU
  python contentctl.py --path . --cached_and_offline generate --product SSA -o dist/ssa
  python contentctl.py --path . --cached_and_offline generate --product SSA -o dist/ssa

content_ctl Progress Monitoring
Previously, content_ctl ran for several minutes and did not provide progress updates. Now, the tool will tell the user what step of the process it is on with an approximate progress meter (0-100%) for validate and generate. Run any of the other commands in this description to see this functionality.

content_ctl Skip Enrichment Except for Tagged Releases
By default, content_ctl will add a significant amount of enrichment (related to referenced CVEs) when running validate and generate. While this is great when generating a release version of the app, it significantly slows down testing and results in a large number of API calls that need to be made. In a non-tagged CI/CD job, the --skip_enrichment flag will be passed to calls to content_ctl, resulting in much faster workflows. However, Enrichment will still run for Tagged Workflows. This could result in a a package passing the pre-tagged CI/CD workflow but failing the Tagged Workflow due to an error in enrichment (for example, a CVE is referenced that does not exist).

Updates to broken or outdated reference links
We use thousands of reference links in security_content and it's important to keep all of these up-to-date. For any variety of reasons, the links can fail or result in redirects. To make finding these issues easier, the argument --check_references (for validate) can be used to examine all references in detections, stories, baselines, etc. The tool examines and prints non-200 return codes and the files that contain them so that the user may troubleshoot them. A very large number of our links had redirects (due to naming scheme changes or company acquisitions) and some sites were no longer accessible (even after searching for the text of the page in Google). In that case, those sites were replaced with Internet Archive links.
About 150 of our references have been updated with the help of this tool - it will be scheduled in the CI to run nightly or weekly so that we can always keep our links fresh.
if --cached_and_offline is used with --check_references, the on subsequent runs of the tool only bad references will be re-checked. Good ones will still be assumed as good.
TEST COMMAND (try running twice to observe the difference):
python contentctl.py --path . --cached_and_offline validate --product ESCU --check_references
python contentctl.py --path . --cached_and_offline validate --product ESCU --check_references