Create style guide for EventData contents

[Onager]

Points to cover:

• What level of meaning to aim for in eventdata vs formatter (bool/string)
• Naming conventions

[joachimmetz]

Make changes to codebase after guide is completed:

• is_friend in plaso/parsers/sqlite_plugins/tango_android.py

[joachimmetz]

Some more points to address:

• storing binary data
• storing data as-is or e.g. int representing a boolean or converting to Python types first
• current role of the formatter
  • should we extend the formatter to unify output?

[joachimmetz]

More points to address:

• event attributes should not be dictionaries (e.g. regvalue)
  • not supported by event filter

[berggren]

+1 on attributes should not be dictionaries, this is also problematic for Elasticsearch for example.

[joachimmetz]

@Onager I've taken a first stab at writing something down https://github.com/log2timeline/plaso/pull/2917. You think we can get this completed as part of the May release?

[joachimmetz]

Don't see this happening before next release, bumping milestone

[joachimmetz]

Marking as blocked, make this part of the migration to dfKinds