Added logic to improve Sysmon KQL generation

[0xffhh]

The current Sysmon "AllVersions" parser is incredibly slow, probably due to the mv-expand or other run-time inefficiencies. Hence, I prefer to use the "old" static but fast runtime parser.

This PR fixes the issue where all KQL columns generated are of type dynamic. This prevents easy joins and other operations which are not allowed on dynamics.

The code takes the type defined in the XML and performs the correct typecasting when generating the columns. Now, the output looks like this:

...
let SYSMONEVENT_IMAGE_LOAD_7=() {
let processEvents = EventData
| where EventID == 7
| extend RuleName = tostring(EventDetail.[0].["#text"]), 
UtcTime = tostring(EventDetail.[1].["#text"]), 
ProcessGuid = tostring(EventDetail.[2].["#text"]), 
ProcessId = toint(EventDetail.[3].["#text"]), 
Image = tostring(EventDetail.[4].["#text"]), 
...