Features/432 syslog input

This should fix #432 

I've extended the SandboxDecoder so that you can supply options to configure timestamp parsing using go's time package.  The code from PayloadDecodeHelper has been refactored so that we can re-use the timestamp parsing code.

The actual syslog parsing is done in a Lua plugin using LPeg as syslog message formats vary widely enough that having something flexible is required.