Adding XL4MA Scanner

[phutelmyer]

Describe the change
Add in XL4MA scanner which attempts to parse and extract Excel 4 macros.
Attempts to extract IOCs (e.g., IPs, Domains) from observed macros.

Describe testing procedures
Tested against several benign and malicious XLSX files with Excel macros.

Sample output

{
  "file": {
    "depth": 0,
    "flavors": {
      "mime": [
        "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
      ],
      "yara": [
        "zip_file",
        "excel4_file"
      ]
...
    "xl4ma": {
      "decoded": [
        "[REDACTED] ",
        "regsvr32.exe",
        "e",
        "empty",
        "mon, URLD",
        "=RETURN()",
        "101",
        "[REDACTED]",
        "[REDACTED] ",
        "False",
        "F",
        "O",
        "X",
        "ownloadToFil",
        "-",
        "i",
        "[REDACTED], ",
        "=",
        "x",
        "<",
        "U",
        "s",
        "C",
        "c",
        "d",
        ", JJCCBB",
        "114",
        ", ",
        "2",
        "D",
        "67",
        "..\\si.ocx",
        "#REF!",
        "3",
        "I",
        "111",
        ":",
        "=IF(FGTA6<0, CLOSE(0), )",
        "[REDACTED], ",
        "o",
        "w",
        "/",
        "B",
        "(",
        "R",
        "(url",
        "=EXEC(C:\\Windows\\SysWow64\\regsvr32.exe -s ..\\si.ocx)",
        "T",
        "\\",
        "SysWow64\\",
        "n",
        "-s",
        "\\Windows\\",
        "&",
        "E",
        "G",
        ".",
        "0",
        "J",
        "u",
        ")",
        "!",
        "61",
        "r",
        "1",
        "A",
        "L",
        "a",
        "8",
        "l",
        "m",
        "S",
        "[REDACTED], ",
        "..\\si.ocx",
        ", 0, 0)",
        "N",
        ", 0, "
      ],
      "elapsed": 0.291986,
      "iocs": [
        "http://[REDACTED]",
        "http://[REDACTED]",
        "http://[REDACTED]",
      ]
    }
...

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of and tested my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings