feat: add analyse evtx subcommand for per-Event-ID summary stats - #231

Closes #160.

Picks up Alex's nudge in #160 (comment) and adds analyse evtx as a generic summary statistics command for evtx files. Scope is exactly what was discussed in that comment, the per-Event-ID frequency table from the issue. The Sigma-hit --statistics variant is left for a separate PR since Alex flagged perf concerns there.

Output matches the format in the original issue:

=== tests/evtx/security_sample.evtx ===
[+] Total records: 10
[+] Security (10 records)
    Event ID    Count
    4624        2
    4672        2
    5058        2
    5059        2
    5061        2

Per-Channel grouping is included because the same Event ID can mean different things in different channels, so a flat table loses information. JSON output is also supported via -j.

Implementation lives in src/analyse/evtx.rs and follows the same shape as src/analyse/gaps.rs: data types (FileEvtxStats, ChannelEventIdStats, EventIdCount), an EvtxAnalyser walker that reads each evtx once, and a print_text_report for human output. EventID extraction handles the cases where it shows up as a JSON number, a string-encoded number, or a tagged object with a #text child.

CLI flags mirror analyse gaps where they apply: --json, -o, -q, --skip-errors. Time-range filtering (--from/--to) is left out for now since the issue did not ask for it. Easy to add later if it is wanted.

Tests cover per-Channel grouping, per-Event-ID counting, sorting within a channel, the empty-input case, and the EventID extraction helper across number, string, and {#text: ...} shapes.

Verified end to end against tests/evtx/security_sample.evtx. Build clean, clippy clean, 27 lib tests pass.