Measure if "threat_hunting" ruleset is worth the CPU cost

[tstromberg]

We always downgrade these rules to "medium" - how much CPU time do we waste on them?

I'd argue that if the rules add 3s+ to a bincapz run on a large binary, I'd remove them.