Support additional ways to specify observables.

[rmouritzen-splunk]

Before this change:

• By type in dictionary using observable property in types
• By object (which can also be thought of as types) using top-level observable property

Add:

• By attribute in dictionary using observable property in attributes
• By attribute in object using observable property in attributes
• By attribute in class using observable property in attributes
• By attribute path in class using top level observables property

Other:

• Fix profile checkbox on Firefox.
• Improve object attribute name tooltip to work like event class attribute name tooltip, showing attribute source as caption of object along with inheritance hierarchy path back to current object (issue: The "source" of object attributes are not accurate #71).
• Add dictionary attributes to the GET /export/schema API. This is needed for automatic observable generation so dictionary attributes observable definitions are considered before class and object specific attributes.

NOTE: Changes are also necessary in ocsf-schema/metaschema and ocsf-validator.

Related issues:

• Expand observables data types, add Name & ID pairs ocsf-schema#960
• Allow 'observables' in attributes ocsf-schema#964
• The "source" of object attributes are not accurate #71

Related PRs:

• Expand scalar observable types ocsf-schema#961
• Add new ways to define observables to metaschema ocsf-schema#982
• Metaschema: support event class and object attribute observables ocsf-schema#993
• Validate observables, including new ways to define ocsf-validator#9
• Event class and object attribute observable validation. Explicit category validation. ocsf-validator#11
• Change observable definitions in patch extends to be unsupported. ocsf-validator#14

[query-jeremy]

This makes sense. I especially like the additions in test/test_ocsf_schema.

[zschmerber]

LGTM thanks for making this!