add version 2.x cluster based analyzer

This version is a major rewrite in that the data structs and
infrastructure are all pulled from the sshd_core.bro .

Because of this the output interface is identical to the sshd_core and
all data is logged in the same place.