* process annotations: thread the tree through santa
* Update enricher to read annotations from the ProcessTree
* rebase changes
* add configuration for annotations, disabling the tree entirely if none are enabled
* lingering build dep
* use tree factory constructor
* fix configurator
* build fixes
* rebase fixes
* fix tests
* review comments
* lint
* english hard
* record metrics even when event only used for process tree
* ProcessTree: add macos-specific loader and event adapter
* lingering darwin->macos
* lint
* remove defunct client id
* struct rename
* and one last header update
* use EndpointSecurityAPI in adapter
* expose esapi in message
* ProcessTree: add core process tree logic
* make Step implicitly called by Handle* methods
* lint
* naming convention
* widen pidversion to be generic
* move os specific backfill to os specific impl
* simplify ts checking
* retain/release a whole vec of pids
* document processtoken
* lint
* namespace
* add process tree to project-wide unit test target
* case change annotations
* case change annotations
* remove stray comment
* default initialize seen_timestamps
* fix missing initialization of refcnt and tombstoned
* reshuffle pb namespace
* pr review
* move annotation registration to tree construction
* use factory function for tree construction
