Rewrite pyvast-threatbus to convert to/from STIX-2 Indicators and Sightings

[0snap]

📔 Description

Following up on the STIX-2 rewrite of Threat Bus: this PR updates pyvast-threatbus.

• Convert STIX-2 Indicators to VAST queries
• Convert VAST query results to valid STIX-2 Sightings
• Convert STIX-2 Indicators to VAST matcher IoCs
• Convert VAST matcher hits to valid STIX-2 Sightings
• Update unit tests

📝 Checklist

• All user-facing changes have changelog entries.
• The changes are reflected on docs.tenzir.com/threatbus, if necessary.
• The PR description contains instructions for the reviewer, if necessary.

🎯 Review Instructions

• Run the unit tests

For live testing:

• start a VAST node w/ matcher plugin enabled
• ingest data into VAST
• start Threat Bus and pyvast-threatbus both from this branch
• send an IoC (e.g., use MISP or the zmq-sender test utils), this should trigger two things (visible with debug logging):
  • a VAST query (for retro matching). If your IoC is found in VAST you should see sightings in the logs
  • an ingest of the IoC into the VAST matcher
• now ingest data again into VAST. If your schema is annotated properly and the data you ingest coincides with the IoCs known to the VAST matcher, it should immediately generate a match during ingest and sightings should show up in the logs

[tobim]

I have almost no critique for this as I can follow the flow of quite well from reading the new implementation in my local working copy.