Make Zeek writer work with all data types

[mavam]

📔 Description

This PR lifts the restriction of the Zeek writer to only dump Zeek events. There is no conceptual limitation, but VAST had an assertition that prevented rendering other data than Zeek.

📝 Checklist

• All user-facing changes have changelog entries.
• The changes are reflected on docs.tenzir.com/vast, if necessary.
• The PR description contains instructions for the reviewer, if necessary.

🎯 Review Instructions

Commit-by-commit.

[mavam]

@tenzir/backend This is the CI failure:

--- /home/runner/work/vast/vast/integration/reference/node-suricata-alert/step_03.ref
510
+++ vast-integration-test/node-suricata-alert/step_03.out
511
@@ -1,7 +1,7 @@
512
-#close	2020-11-26-15-24-33
513
+#close	2020-11-26-15-42-56
514
 #empty_field	(empty)
515
 #fields	timestamp	flow_id	pcap_cnt	vlan	in_iface	src_ip	src_port	dest_ip	dest_port	proto	event_type	community_id	alert.app_proto	alert.action	alert.gid	alert.signature_id	alert.rev	alert.signature	alert.category	alert.severity	alert.source.ip	alert.source.port	alert.target.ip	alert.target.port	flow.pkts_toserver	flow.pkts_toclient	flow.bytes_toserver	flow.bytes_toclient	flow.start	flow.end	flow.age	flow.state	flow.reason	flow.alerted	payload	payload_printable	stream	packet	packet_info.linktype
516
-#open	2020-11-26-15-24-33
517
+#open	2020-11-26-15-42-56
518
 #path	alert
519
 #separator 	
520
 #set_separator	,

The problem is obvious: The #open and #close comments are not deterministic. Should we add a flag to the Zeek export to omit them? They are optional, after all. I was thinking of something along the lines of vast export zeek --no-meta-timestamps.

[lava]

Looks good to me