Allow envelope to support multiple layers

[mdavis332]

some APIs that return json objects with the useful data nested layers deep (apwg /mal_ip, i'm looking at you) do not seem to currently work with json parser. Add ability for envelope to peel back Matryoshka doll envelopes, e.g.:

{ 
  '_meta': 'some garbage', 
  '_links': 'other stuff', 
  '_embedded': {
    'mal_ips': [ 'finally the good stuff', 'oh yeah' ] 
  } 
}

rule.yml:

...
envelope:
  - _embedded
  - _mal_ips
...