Move logstash formatting logic out of logstash encoder

This allows it to be reused in other components.
Obvious layout implementation using logstash formatter
Implement socket appender on top of the syslog implementation

It turns out that the syslog base is not syslog-specific, but just ships
the data in any given layout over UDP. (The facilty / severity are not
used in the default implementation.)

If you configure logstash like so:

    input {
      udp {
        port => 5515
        format => json_event
        tag => my_tag_for_logback_events
      }
    }

and logback like so:

    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashSocketAppender">
      <host>my.logstash.server.local</host>
      <port>5515</port>
    </appender>

log messages will be sent directly to the server, with no need for a
logstash daemon running locally.